Vulnerability · Published Aug 10, 2026 · Assigned by redhat

CVE-2026-19404389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance

Medium 6.5

In plain English

A medium-severity missing authorization in Red Hat Directory Server 11 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	389-ds-base	no fix listed	DEBIAN-CVE-2026-19404
Debian:13	389-ds-base	no fix listed	DEBIAN-CVE-2026-19404
Ubuntu:22.04:LTS	389-ds-base	no fix listed	UBUNTU-CVE-2026-19404
Ubuntu:24.04:LTS	389-ds-base	no fix listed	UBUNTU-CVE-2026-19404
Ubuntu:26.04:LTS	389-ds-base	no fix listed	UBUNTU-CVE-2026-19404
Ubuntu:26.10	389-ds-base	no fix listed	UBUNTU-CVE-2026-19404

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Directory Server 11	see references
Red Hat	Red Hat Directory Server 12	see references
Red Hat	Red Hat Directory Server 13	see references
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 6	see references
Red Hat	Red Hat Enterprise Linux 7	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 9	see references

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

https://access.redhat.com/security/cve/CVE-2026-19404 vdb-entry, x_refsource_REDHAT
RHBZ#2513036 issue-tracking, x_refsource_REDHAT