Vulnerability · Published Oct 1, 2026 · Assigned by redhat
CVE-2026-86345389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result
Critical 9.0
In plain English
A critical-severity security flaw in Red Hat Directory Server 11 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | 389-ds-base | no fix listed | DEBIAN-CVE-2026-86345 |
| Debian:13 | 389-ds-base | no fix listed | DEBIAN-CVE-2026-86345 |
| Ubuntu:22.04:LTS | 389-ds-base | no fix listed | UBUNTU-CVE-2026-86345 |
| Ubuntu:24.04:LTS | 389-ds-base | no fix listed | UBUNTU-CVE-2026-86345 |
| Ubuntu:26.04:LTS | 389-ds-base | no fix listed | UBUNTU-CVE-2026-86345 |
| Ubuntu:26.10 | 389-ds-base | no fix listed | UBUNTU-CVE-2026-86345 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Directory Server 11 | see references |
| Red Hat | Red Hat Directory Server 11 | see references |
| Red Hat | Red Hat Directory Server 12 | see references |
| Red Hat | Red Hat Directory Server 12 | see references |
| Red Hat | Red Hat Directory Server 13 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-923 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://access.redhat.com/security/cve/CVE-2026-86345 vdb-entry, x_refsource_REDHAT
- RHBZ#2529332 issue-tracking, x_refsource_REDHAT