CVE-2026-18651

NameCVE-2026-18651
DescriptionA flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1143603

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
389-ds-base (PTS)bullseye1.4.4.11-2vulnerable
bullseye (security)1.4.4.11-2+deb11u1vulnerable
bookworm2.3.1+dfsg1-1+deb12u1vulnerable
trixie3.1.2+dfsg1-1+deb13u1vulnerable
sid3.3.0-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
389-ds-basesource(unstable)(unfixed)1143603

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2510617

Search for package or bug name: Reporting problems