CVE-2026-18922: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-18922 is a critical improper authentication vulnerability in Red Hat's 389 Directory Server (389-ds-base) that allows a remote, unauthenticated attacker to gain full Directory Manager privileges by exploiting stale identity data in Cyrus SASL auxiliary properties. The flaw was reported by Chris Jarrett-Davies of OpenAI Security Research, filed in Bugzilla on August 5, 2026, and publicly disclosed on September 7, 2026. Affected products include Red Hat 389-ds-base across multiple Red Hat Enterprise Linux and related product streams (specific fixed versions not yet published at time of disclosure). It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat CVE, Github Advisory).

The root cause (CWE-287: Improper Authentication) lies in two functions within ldap/servers/slapd/saslbind.c: ids_sasl_canon_user() unconditionally writes the resolved bind DN into a Cyrus SASL auxiliary property (prop_set) on every canonicalization attempt — including failed ones — and ids_sasl_check_bind() reads back and installs the identity from the auxiliary property (dnval[0].values[0]) without verifying which SASL mechanism completed the second bind or whether the stored value is fresh. Because a failed SASL PLAIN bind does not trigger SASL-context recreation, the stale Directory Manager DN persists in slot 0 of the auxiliary property. An attacker exploits this over the network with no privileges by: (1) sending a SASL PLAIN bind as cn=Directory Manager with an incorrect password (fails, but plants the DN), then (2) completing a SASL ANONYMOUS bind on the same connection, causing the server to install the stale Directory Manager identity. A variant requiring one valid low-privileged account credential is also possible. The flaw was verified against 389-ds-base-2.9.0 at commit 33c0e0115c03017ba94ee02f144383704de32a25 (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation grants a remote, unauthenticated attacker full Directory Manager authority over the 389 Directory Server instance, resulting in complete compromise of confidentiality, integrity, and availability. An attacker can read all directory data (including sensitive attributes like nsslapd-rootdn in cn=config), modify or delete any LDAP entries, and disrupt directory services — all without any valid credentials and without user interaction. Because 389 Directory Server commonly serves as a central identity and authentication backend (e.g., in Red Hat Identity Management / FreeIPA environments), exploitation could enable broad lateral movement across any systems relying on the directory for authentication (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code has been published as of the disclosure date, though a reporter's PoC was independently reproduced by Red Hat Product Security in an isolated sandbox (Red Hat Bugzilla). There is no confirmed in-the-wild exploitation at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is currently 0.0, reflecting early-stage disclosure (Feedly). However, the attack requires no credentials, no user interaction, and no non-default configuration, making it highly accessible to any network-adjacent attacker once exploitation techniques become more widely known.

1. Reconnaissance: Identify internet- or network-facing 389 Directory Server instances (LDAP port 389 or LDAPS port 636) using network scanners (e.g., Nmap, Shodan) and confirm SASL PLAIN is among the advertised supported mechanisms via an LDAP rootDSE query (ldapsearch -x -H ldap://<target> -b '' -s base supportedSASLMechanisms).
2. Establish TCP connection: Open a persistent LDAP/LDAPS connection to the target server — the exploit requires both bind attempts to occur on the same connection.
3. Plant stale identity via failed SASL PLAIN bind: Send a SASL PLAIN bind request authenticating as cn=Directory Manager with an intentionally incorrect password. The server rejects the bind, but ids_sasl_canon_user() has already written the Directory Manager DN into slot 0 of the Cyrus SASL auxiliary property for this connection.
4. Complete SASL ANONYMOUS bind on the same connection: Without closing the connection, send a SASL ANONYMOUS bind request. The server's ids_sasl_check_bind() reads dnval[0].values[0] from the auxiliary property without verifying mechanism or freshness, installing the stale Directory Manager DN as the authenticated identity.
5. Verify privilege escalation: Issue a "Who Am I?" extended operation (ldapwhoami) — the server returns dn:cn=directory manager, confirming full Directory Manager authority.
6. Exploit Directory Manager access: Read, modify, or delete any LDAP entries; extract password hashes; add new privileged accounts; or modify authentication policies to enable persistent access (Red Hat Bugzilla, Red Hat CVE).

• Network: Repeated LDAP/LDAPS connections from the same source IP performing multiple bind attempts in rapid succession; SASL PLAIN bind attempts for cn=Directory Manager followed immediately by SASL ANONYMOUS binds on the same connection; unexpected LDAP connections from external or untrusted IP ranges to port 389/636.
• Logs: 389 Directory Server access logs (/var/log/dirsrv/slapd-<instance>/access) showing a failed SASL PLAIN bind for cn=Directory Manager immediately followed by a successful bind (ANONYMOUS or other mechanism) from the same connection/client; Who Am I? extended operation responses returning dn:cn=directory manager for connections that did not authenticate with valid Directory Manager credentials.
• Directory Activity: Unexpected reads of privileged cn=config attributes (e.g., nsslapd-rootdn); unauthorized creation or modification of user accounts or ACIs; bulk LDAP searches or exports of directory content by unfamiliar clients.
• Process/System: Unusual child processes or scripts spawned in the context of the dirsrv service account following LDAP activity (Red Hat Bugzilla, Red Hat CVE).

Red Hat has not yet published fixed package versions as of the disclosure date; administrators should monitor Red Hat Security Advisories for errata. As an immediate workaround, restrict the nsslapd-allowed-sasl-mechanisms attribute to only the mechanisms actually required (e.g., GSSAPI, EXTERNAL, GSS-SPNEGO), explicitly excluding PLAIN — since both exploit variants require an initial SASL PLAIN bind to plant the stale identity, removing PLAIN from the allowed list blocks the attack entirely. Additionally, restrict network access to LDAP/LDAPS ports (389/636) to trusted hosts only, and monitor access logs for the suspicious bind sequence described above (Red Hat CVE, Red Hat Bugzilla).

Red Hat Product Security independently confirmed the vulnerability in an isolated sandbox and rated it Critical, noting it allows a remote unauthenticated attacker to gain full Directory Manager privileges with no valid account, no user interaction, and no non-default configuration required (Red Hat CVE). The vulnerability was credited to Chris Jarrett-Davies of OpenAI Security Research. Early social media activity on Mastodon (infosec.exchange) and Bluesky noted the disclosure shortly after publication, and aggregator sites (VulDB, CVEFeed, OffSeq Radar) indexed the CVE within hours of disclosure.