CVE-2026-19404

NameCVE-2026-19404
DescriptionA flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
389-ds-base (PTS)bullseye1.4.4.11-2vulnerable
bullseye (security)1.4.4.11-2+deb11u1vulnerable
bookworm2.3.1+dfsg1-1+deb12u1vulnerable
trixie3.1.2+dfsg1-1+deb13u1vulnerable
sid3.3.0-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
389-ds-basesource(unstable)(unfixed)

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2513036

Search for package or bug name: Reporting problems