CVE-2026-19404

A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable.

A Moderate impact flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an attacker able to reach a supplier's LDAP listener to remove a replica's entry from replication metadata, purge its changelog records, or interrupt an administrator's in-progress cleanup. Red Hat products with nsslapd-allow-anonymous-access enabled by default (the shipped default) allow this without any authentication; when that setting has been restricted, any authenticated account, regardless of privilege level, can still trigger the same behavior, since the affected operations do not perform an authorization check of their own.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Set nsslapd-allow-anonymous-access to rootdse or off as an interim mitigation. Note this only blocks exploitation by fully unauthenticated (unbound) clients; any connection that has completed a successful bind with any DN, including a low-privileged account, still reaches the vulnerable handlers with no further authorization check. Restrict replication LDAP ports to trusted networks as defense in depth pending a code fix.