High severity7.5NVD Advisory· Published Sep 7, 2026· Updated Oct 8, 2026
CVE-2026-76560
CVE-2026-76560
Description
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
11- osv-coords9 versionspkg:rpm/opensuse/389-ds&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/389-ds-basepkg:rpm/opensuse/389-ds&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/389-ds-base-bdbpkg:rpm/almalinux/389-ds-base-libspkg:rpm/almalinux/389-ds-base-legacy-toolspkg:rpm/almalinux/python3-lib389pkg:rpm/almalinux/389-ds-base-develpkg:rpm/almalinux/389-ds-base-snmp
< 3.0.7~git2.2846d5288-160000.1.1+ 8 more
- (no CPE)range: < 3.0.7~git2.2846d5288-160000.1.1
- (no CPE)range: < 2.8.0-10.el9_8
- (no CPE)range: < 3.3.1+8c2711bd6-1.1
- (no CPE)range: < 3.2.0-10.el10_2
- (no CPE)range: < 2.8.0-10.el9_8
- (no CPE)range: < 1.4.3.39-28.module_el8.10.0+4274+00f9a3f1
- (no CPE)range: < 2.8.0-10.el9_8
- (no CPE)range: < 2.8.0-10.el9_8
- (no CPE)range: < 2.8.0-10.el9_8
Patches
Vulnerability mechanics
References
19- access.redhat.com/errata/RHSA-2026:64771nvd
- access.redhat.com/errata/RHSA-2026:64776nvd
- access.redhat.com/errata/RHSA-2026:64778nvd
- access.redhat.com/errata/RHSA-2026:64779nvd
- access.redhat.com/errata/RHSA-2026:64780nvd
- access.redhat.com/errata/RHSA-2026:64781nvd
- access.redhat.com/errata/RHSA-2026:64783nvd
- access.redhat.com/errata/RHSA-2026:64784nvd
- access.redhat.com/errata/RHSA-2026:64785nvd
- access.redhat.com/errata/RHSA-2026:64789nvd
- access.redhat.com/errata/RHSA-2026:64790nvd
- access.redhat.com/errata/RHSA-2026:64791nvd
- access.redhat.com/errata/RHSA-2026:64792nvd
- access.redhat.com/errata/RHSA-2026:64793nvd
- access.redhat.com/errata/RHSA-2026:64804nvd
- access.redhat.com/errata/RHSA-2026:65119nvd
- access.redhat.com/errata/RHSA-2026:79217nvd
- access.redhat.com/security/cve/CVE-2026-76560nvd
- bugzilla.redhat.com/show_bug.cginvd
News mentions
1- FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator CredentialsThe Hacker News · Sep 8, 2026