CVE-2026-19404 in Directory Server
Summary
by MITRE • 08/10/2026
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability exists within the 389 Directory Server implementation where two critical replication maintenance operations lack proper authorization controls. The CleanAllRUV and Abort CleanAllRUV extended operations represent fundamental administrative functions designed to manage replication metadata and changelog records within directory services. These operations are intended to be restricted to privileged administrators who possess elevated permissions within the system architecture. However, the flaw allows for unauthorized invocation through the absence of mandatory access controls during operation execution.
This security weakness stems from improper privilege enforcement mechanisms within the server's authentication framework. When nsslapd-allow-anonymous-access is enabled, which represents the default configuration setting, any remote attacker can exploit this vulnerability without requiring prior authentication credentials. Even in scenarios where anonymous access is disabled, low-privilege authenticated users can still leverage these operations due to the missing authorization checks. The vulnerability directly violates principle of least privilege and proper access control enforcement as outlined in security standards such as cwe-284.
The operational impact of this flaw extends beyond simple unauthorized access to encompass significant replication disruption capabilities. An attacker who successfully exploits this vulnerability can remove replica IDs from replication metadata, effectively corrupting the directory service's understanding of its distributed architecture. Additionally, the changelog records that track modifications across replicated systems can be purged, eliminating critical audit trails and historical change data. These actions can interrupt administrator-initiated cleanup operations and leave the replication environment in an inconsistent state, potentially causing service outages or data loss scenarios.
The security implications align with several attack patterns documented in the attack tactics and techniques framework, particularly those related to privilege escalation and denial of service. This vulnerability enables unauthorized users to perform administrative functions that should require elevated privileges, creating opportunities for both data integrity compromise and availability disruption. The flaw represents a critical weakness in the directory service's replication management system and can be exploited to undermine the reliability and trustworthiness of the entire directory infrastructure.
Organizations should immediately disable anonymous access unless specifically required for legitimate operational purposes, and implement strict access controls for all administrative operations. The recommended mitigations include configuring proper authorization policies using the server's built-in access control mechanisms, monitoring replication operations for unauthorized access attempts, and implementing network segmentation to limit exposure of directory service components. Additionally, regular security assessments should verify that access controls are properly enforced for all extended operations within the directory service implementation.