A flaw was found in 389-ds-base.

CVE-2026-86345 is a StartTLS plaintext buffer retention flaw in 389-ds-base — the LDAP directory server powering Red Hat Directory Server, FreeIPA/IdM, and RHEL identity infrastructure. When a client initiates a StartTLS upgrade on port 389, the server replaces the socket with a TLS-wrapped one but fails to flush pre-TLS plaintext bytes from the connection buffer. An on-path attacker who injects a crafted LDAP message (e.g., an anonymous BindRequest with a predictable messageID) into the same TCP segment as the StartTLS request can cause the server to process that smuggled message *after* TLS is active. The server delivers the forged response — a successful bind — through the encrypted channel, and the client's PAM/SSSD module accepts it as genuine. Confirmed vulnerable: 389-ds-base-2.6.1-6.el9_6. Affected across Red Hat Directory Server 11/12/13 and RHEL 6 through 10 plus all derivatives (AlmaLinux, Oracle Linux, Rocky, CentOS Stream, Fedora).

Red Hat rates this CRITICAL at 9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). The AC:H accurately captures the MITM prerequisite, and S:C is appropriate because the impact crosses from the directory server to every downstream client trusting LDAP bind results. However, the score slightly overstates *immediate* urgency: there is no public PoC, no in-the-wild exploitation, and the attack requires an already-compromised internal network position. One report suggests Red Hat's own qualitative rating is actually Moderate despite the 9.0 base score. noisgate holds the CRITICAL floor regardless, because 389-ds-base is canonically identity infrastructure — the vast majority of its installations serve as the authentication backbone for Linux environments — and a successful exploit means domain-scale authentication bypass. We adjust the score to 8.6 to reflect the no-PoC, no-exploitation reality while honoring the blast-radius floor.

Under the noisgate mitigation SLA for CRITICAL, deploy the primary compensating control — switching all 389-ds-base instances to LDAPS-only on port 636 by disabling the plaintext port — within 3 days. This single change eliminates the entire StartTLS attack surface. Under the noisgate remediation SLA, apply the vendor patch (via RHSA-2026:64784 or your distro's equivalent) within 90 days to fully resolve the underlying buffer handling defect. If KEV listing or active exploitation evidence emerges, override both timelines and patch immediately.

Sources.

1. Red Hat Bugzilla #2529332
2. Red Hat Security CVE Page
3. Threat Radar — CVE-2026-86345 Intelligence
4. TheHackerWire — CVE-2026-86345 Analysis
5. Strix.ai — CVE-2026-86345 Advisory
6. Exploit Intelligence Platform — CVE-2026-86345
7. SecurityOnline — Foreman RCE + 389-ds Coverage
8. Red Hat Errata RHSA-2026:26459

Run as root (or the dirsrv user) on each host running 389-ds-base / Red Hat Directory Server. Invoke: sudo bash cve_2026_86345_check.sh. No arguments. Checks all local DS instances for StartTLS exposure. Outputs VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# CVE-2026-86345 checker — 389-ds-base StartTLS buffer retention auth bypass
# Run as root on each 389-ds-base host.
# Exit codes: 0 = PATCHED/NOT APPLICABLE, 1 = VULNERABLE, 2 = UNKNOWN
set -uo pipefail

echo "=== CVE-2026-86345: 389-ds-base StartTLS Buffer Retention ==="
echo ""

# 1. Check if 389-ds-base is installed
if ! rpm -q 389-ds-base &>/dev/null 2>&1; then
  echo "[*] 389-ds-base is NOT installed on this host."
  echo "PATCHED"  # Not applicable — software not present
  exit 0
fi

PKG=$(rpm -q 389-ds-base)
echo "[*] Installed package: $PKG"

# 2. Scan each Directory Server instance
EXPOSED=0
MITIGATED=0
NO_INSTANCES=1

for CONF in /etc/dirsrv/slapd-*/dse.ldif; do
  [ -f "$CONF" ] || continue
  NO_INSTANCES=0
  INST=$(echo "$CONF" | grep -oP 'slapd-\K[^/]+')
  echo ""
  echo "[*] Instance: $INST"

  PORT=$(awk -F': ' '/^nsslapd-port:/{print $2; exit}' "$CONF" 2>/dev/null)
  SEC=$(awk -F': ' 'tolower($0) ~ /^nsslapd-security:/{print tolower($2); exit}' "$CONF" 2>/dev/null)
  SECPORT=$(awk -F': ' '/^nsslapd-secureport:/{print $2; exit}' "$CONF" 2>/dev/null)

  echo "    Plaintext port (StartTLS): ${PORT:-389}"
  echo "    nsslapd-security:          ${SEC:-off}"
  echo "    Secure port (LDAPS):       ${SECPORT:-636}"

  if [[ "${PORT:-389}" != "0" && "${SEC:-off}" == "on" ]]; then
    echo "    !! StartTLS path is ENABLED on port ${PORT:-389} — EXPOSED"
    EXPOSED=1
  elif [[ "${PORT:-389}" == "0" ]]; then
    echo "    Plaintext port disabled (LDAPS-only) — mitigated."
    MITIGATED=1
  else
    echo "    TLS not enabled at all — not exposed to THIS CVE,"
    echo "    but plaintext LDAP without any encryption is a larger issue."
    MITIGATED=1
  fi
done

echo ""
if [[ $NO_INSTANCES -eq 1 ]]; then
  echo "[*] No Directory Server instances found in /etc/dirsrv/."
  echo "PATCHED"  # Not applicable
  exit 0
fi

if [[ $EXPOSED -eq 1 ]]; then
  echo "VULNERABLE"
  echo "ACTION: Set nsslapd-port: 0 to disable plaintext port,"
  echo "        enforce LDAPS on port 636, update all client URIs"
  echo "        to ldaps://, or apply vendor patch."
  exit 1
elif [[ $MITIGATED -eq 1 ]]; then
  echo "PATCHED"
  echo "(Mitigated: LDAPS-only mode; StartTLS upgrade path not reachable.)"
  exit 0
else
  echo "UNKNOWN"
  echo "Manual review of instance configuration required."
  exit 2
fi