CVE-2026-18651
Description
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat directory_server | 11.0, 12.0, 13.0 | — |
| redhat 389_directory_server | No range specified | — |
| redhat enterprise_linux | 7.0, 8.0, 9.0, 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.