Executive Summary
A critical authentication flaw (CVE-2026-18922) in 389 Directory Server (and downstream Red Hat Directory Server 11) allows an attacker to escalate to the highest-privileged account in the directory — Directory Manager — without ever presenting valid credentials. The bug lives in how the server's Cyrus SASL layer tracks identity state across bind attempts on the same connection.
CVSS Score: 9.8 (Critical)
During SASL PLAIN authentication, a stale identity carried over from a prior, failed bind attempt can be installed onto the connection after a subsequent, unrelated successful bind completes — regardless of which SASL mechanism that second bind actually uses. In practice, that means a failed login attempt as cn=Directory Manager can leave enough residue behind that a completely unrelated, low-privilege (or even anonymous) bind afterward inherits Directory Manager authority.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-18922 |
| CVSS Score | 9.8 (Critical) |
| Type | Improper Authentication / Privilege Escalation |
| Component | Cyrus SASL auxiliary property handling in 389-ds-base |
| Attack Vector | Network (LDAP bind sequence, no valid credentials required) |
| Privileges Required | None |
| Reserved | 2026-08-05 |
| Published | 2026-09-07 |
| Assigning CNA | Red Hat |
How the Bypass Works
The flaw is a state-cleanup bug, not a cryptographic weakness. Cyrus SASL stores an authentication identity in an auxiliary property attached to the connection. When a bind fails, the server does not reliably clear that property before the next bind attempt runs on the same connection.
A typical exploitation sequence looks like this:
1. Attacker opens an LDAP connection to the directory server
2. Attacker sends a SASL PLAIN bind as cn=Directory Manager
using an incorrect password — the bind FAILS
3. The failed bind leaves a stale "Directory Manager" identity
in the connection's SASL auxiliary property
4. Attacker sends a second, unrelated bind on the SAME
connection — e.g. SASL ANONYMOUS, or a valid bind as a
low-privileged account
5. The server installs the stale Directory Manager identity
onto the now-authenticated connection
6. Attacker now operates the directory with full
Directory Manager authorityA variant of the attack substitutes a valid low-privileged account's own successful bind for the anonymous bind in step 4 — meaning an attacker with any legitimate, unprivileged LDAP credential can potentially use this bug to escalate to Directory Manager.
Why This Matters
Directory Manager is the LDAP equivalent of root: it bypasses access control lists, can read and write every entry in the directory, and can modify server configuration. A directory server exposed to untrusted networks — or to any user who can open an LDAP connection — is a single multi-step bind sequence away from full compromise.
Affected Software
| Product | Status |
|---|---|
| 389-ds-base (upstream 389 Directory Server) | Affected |
| Red Hat Directory Server 11 | Affected |
This is a separate issue from CVE-2026-18651, another recently disclosed 389 Directory Server SASL PLAIN flaw that involves bypassing account-lockout rather than Directory Manager escalation. Administrators tracking both CVEs should not assume patching one addresses the other.
Remediation
- Patch immediately. Apply the latest 389-ds-base / Red Hat Directory Server updates that harden the SASL layer to explicitly clear auxiliary properties on any bind failure and enforce strict isolation between bind contexts sharing a connection.
- Restrict network exposure. Limit which hosts can open LDAP/LDAPS connections to directory servers, particularly for instances reachable from outside a trusted management network.
- Enforce connection hygiene. Where supported, configure connection timeouts and limits on the number of bind attempts permitted per connection to shrink the window for multi-step exploitation.
- Audit authentication logs. Review directory server logs for the tell-tale pattern of a failed Directory Manager bind followed immediately by a second, different bind from the same source connection or IP — this sequence is the core signature of exploitation.
- Rotate the Directory Manager password as a precaution if logs show any suspicious bind sequences predating the patch.
Detection Indicators
| Indicator | Description |
|---|---|
Failed cn=Directory Manager SASL PLAIN bind followed by a second bind on the same connection | Core exploitation signature |
| Directory Manager-level operations performed by connections that authenticated as anonymous or low-privileged | Evidence of successful escalation |
| Unexpected configuration or ACL changes with no corresponding legitimate admin bind | Post-exploitation activity |