CVE-2026-11785

A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.

This Moderate impact flaw in 389 Directory Server allows an authenticated, non-administrator user to obtain partial stack address information. The SSO token feature, which is enabled by default in Red Hat Directory Server, leaks the lower 32 bits of a stack address in LDAP extended operation responses, reducing Address Space Layout Randomization (ASLR) entropy but not leading to a full bypass.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Option 1 (Recommended): Disable the SSO token feature entirely: dsconf <instance> config replace nsslapd-enable-ldapssotoken=off. This prevents the vulnerable code path from being reached but disables SSO token functionality for all users. Option 2: Restrict network access to LDAP ports (389/636) to trusted networks via firewall rules. Note: Removing the SSO token secret from configuration does not mitigate the vulnerability — the server auto-generates a new secret at startup.