CVE-2026-19843: Red Hat Directory Server 11

High severity, CVSS 8.4. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

Affected products

  • Red Hat Red Hat Directory Server 11
  • Red Hat Red Hat Directory Server 11.5 e4s For Rhel 8: before 8060020260908152739.0ca98e7e (fixed in 8060020260908152739.0ca98e7e)
  • Red Hat Red Hat Directory Server 11.7 e4s For Rhel 8: before 8080020260903102346.f969626e (fixed in 8080020260903102346.f969626e)
  • Red Hat Red Hat Directory Server 11.9 For Rhel 8: before 8100020260904171440.37ed7c03 (fixed in 8100020260904171440.37ed7c03)
  • Red Hat Red Hat Directory Server 12
  • Red Hat Red Hat Directory Server 12.2 e4s For Rhel 9: before 9020020260903155914.1674d574 (fixed in 9020020260903155914.1674d574)
  • Red Hat Red Hat Directory Server 12.4 e4s For Rhel 9: before 9040020260903102623.1674d574 (fixed in 9040020260903102623.1674d574)
  • Red Hat Red Hat Directory Server 12.6 Eus For Rhel 9: before 9060020260903100230.1674d574 (fixed in 9060020260903100230.1674d574)
  • Red Hat Red Hat Directory Server 12.8 For Rhel 9: before 9080020260908092641.1674d574 (fixed in 9080020260908092641.1674d574)
  • Red Hat Red Hat Directory Server 13.0 Eus For Rhel 10: before 0:3.0.6-4.el10dsrv (fixed in 0:3.0.6-4.el10dsrv)
  • Red Hat Red Hat Directory Server 13.2 For Rhel 10: before 0:3.2.0-7.el10dsrv (fixed in 0:3.2.0-7.el10dsrv)
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Published 2026-09-07. Last modified 2026-10-08.