{"id":"CVE-2026-19404","title":"389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance","summary":"A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-ano…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-862"],"vendor":"Red Hat","product":"389-ds-base","affected":["389-ds-base (all versions)","389-ds-base (all versions)","389-ds-base (all versions)","389-ds-base (all versions)","389-ds-base","389-ds-base (all versions)","389-ds-base (all versions)","389-ds-base (all versions)"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-10T18:32:53.431269Z"},"published":"2026-08-10","updated":"2026-11-05","sourceUpdated":"2026-11-05T19:26:20.011Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-19404","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-19404"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2513036","label":"RHBZ#2513036"}],"tags":["cve.org"],"epss":0.00434,"epssPercentile":0.37865,"ingestedAt":"2026-11-05T22:38:31.544Z","slug":"CVE-2026-19404","body":"## Overview\n\nA flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable.\n\n## Affected\n\n- `389-ds-base (all versions)`\n- `389-ds-base (all versions)`\n- `389-ds-base (all versions)`\n- `389-ds-base (all versions)`\n- `389-ds-base`\n- `389-ds-base (all versions)`\n- `389-ds-base (all versions)`\n- `389-ds-base (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nSet nsslapd-allow-anonymous-access to rootdse or off as an interim mitigation. Note this only blocks exploitation by fully unauthenticated (unbound) clients; any connection that has completed a successful bind with any DN, including a low-privileged account, still reaches the vulnerable handlers with no further authorization check. Restrict replication LDAP ports to trusted networks as defense in depth pending a code fix.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}