High severity8.4NVD Advisory· Published Sep 7, 2026

CVE-2026-19843

Description

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Red Hat/Cockpit 389 Consolellm-create
Red Hat/389-ds-basellm-fuzzy

Patches

Vulnerability mechanics

References

access.redhat.com/security/cve/CVE-2026-19843nvd
bugzilla.redhat.com/show_bug.cginvd

News mentions

No linked articles in our index yet.

cvss	0.546
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000