CVE-2026-76560 in Directory Server
Summary
by MITRE • 09/07/2026
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The 389 Directory Server is a widely deployed open-source implementation of the Lightweight Directory Access Protocol (LDAP) service, commonly utilized for centralized identity management and authentication across enterprise environments. A critical security flaw has been identified within its Access Control Instruction evaluation logic, specifically concerning how Self-Distinguished Name SELFDN rules are processed during bind operations. This vulnerability stems from a logical error in the bind-rule evaluator that mishandles anonymous LDAP clients attempting to authenticate against directory entries protected by SELFDN-based access controls. The core issue lies in the comparison mechanism used to validate whether an incoming client matches the identity specified in the ACI rule.
When an unauthenticated or anonymous client initiates a connection, it typically provides an empty bind distinguished name DN as part of its authentication credentials. In standard LDAP operations, this signals that no specific user identity is being asserted. However, due to the flaw described, the SELFDN evaluator incorrectly treats this empty string from the client as equivalent to an empty stored attribute value within a directory entry. This equivalence check allows the anonymous request to pass through access control checks that were explicitly designed to restrict operations to a single authenticated individual whose identity is derived from their own distinguished name or specific attributes. Consequently, the security boundary intended by the administrator is bypassed without requiring valid credentials for any user account.
The operational impact of this vulnerability is severe as it effectively grants unauthorized write privileges to anonymous users in configurations where SELFDN ACIs are employed to manage self-service modifications such as password changes or profile updates. An attacker can exploit this logic error to add new entries, modify existing attributes, or delete objects within the directory tree without possessing any valid authentication credentials. This represents a complete failure of confidentiality and integrity controls for affected directories. The ability to perform write operations anonymously undermines the fundamental trust model of LDAP services where identity assertion is required before privilege escalation occurs.
From a classification perspective this vulnerability aligns with CWE-287 Improper Authentication as it involves failing to properly verify the identity of an actor during authentication processes and also relates to CWE-269 Privilege Escalation since unauthenticated users gain capabilities reserved for authenticated entities. In terms of adversary behavior mapping under MITRE ATT&CK this flaw facilitates Initial Access through Untrusted Credential Manipulation allowing attackers to interact with directory services without detection via standard credential validation mechanisms which may evade basic security monitoring tools that rely on successful login events as indicators of compromise.
Mitigation strategies must focus on immediate patching and configuration review organizations running affected versions of 389 Directory Server should apply the latest vendor-provided updates that correct the bind-rule evaluation logic to ensure empty strings are not treated as valid matches for SELFDN attributes until proper authentication has occurred administrators should also audit their ACI configurations to identify any rules relying on self-referential identity checks and consider implementing additional network-level restrictions such as IP whitelisting or TLS mutual authentication where feasible to reduce the attack surface exposed to anonymous connections.