A stale SASL identity bug in 389 Directory Server lets an unauthenticated attacker gain full Directory Manager authority on a connection without ever supplying a valid password, earning a CVSS 9.8 critical rating.
What Is It
The flaw sits in how 389 Directory Server handles SASL PLAIN authentication. A stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection after a subsequent, unrelated successful bind; regardless of which SASL mechanism completes that second bind.
The attack path is short. An attacker sends a SASL PLAIN bind as cn=Directory Manager with an incorrect password. That bind fails, but the identity lingers. The attacker then completes a SASL ANONYMOUS bind on the same connection, and the server grants Directory Manager authority with no valid credentials presented. A variant works the same way using a valid low-privileged account's own successful bind in place of the anonymous one.
Red Hat tracks the issue as CWE-287 (Improper Authentication).
Why It Matters
The CVSS 3.1 base score is 9.8 CRITICAL, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact.
Directory Manager is the superuser of a 389 DS instance. An attacker reaching the LDAP port with two ordinary bind operations obtains complete control over the directory: reading every entry, modifying accounts, and altering the authentication substrate that dependent systems trust. The low-privileged-account variant means environments that block anonymous binds are not automatically out of scope.
CVE-2026-18922 does not appear in the CISA Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed at this time.
What's Vulnerable
Red Hat's advisory tracks the 389-ds-base package against the following products:
- Red Hat Directory Server 11 and 12
- Red Hat Enterprise Linux 6, 7, 9, and 10
- Red Hat Enterprise Linux 8 (module stream
389-ds:1.4/389-ds-base)
Red Hat Directory Server 13 is listed as unaffected.
These are the product entries Red Hat enumerates for the flaw, not a confirmed list of shipping vulnerable builds; several of the listed RHEL releases are past their standard maintenance window, and per-product status can differ from mere inclusion in the tracking list. Confirm the state of a specific release and package version against the Red Hat CVE page before scoping remediation.
Patch Status
The CVE was published 2026-09-07 with NVD status "Received." The supplied source material lists no fixed package versions, no vendor remediation guidance, and no required-action deadline. Consult the Red Hat CVE page and Bugzilla entry below for current errata status.
Sources
- NVD, CVE-2026-18922 (source: [email protected])
- Red Hat Security; https://access.redhat.com/security/cve/CVE-2026-18922
- Red Hat Bugzilla #2511388; https://bugzilla.redhat.com/show_bug.cgi?id=2511388
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog