CVEvulnerability

CVE-2026-19843

8.4 HIGH Published 2026-09-07 Modified 2026-10-08 Official page ↗
Status
Awaiting Analysis
Published
2026-09-07
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.4 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-78

Description

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References