A security defect tracked as CVE-2026-86345 (CVSS 8.1, GHSA-c4v7-fhgq-r988) has been disclosed in 389 Directory Server (389-ds-base), the foundational enterprise LDAP server powering Red Hat Directory Server, FreeIPA, and thousands of corporate enterprise identity environments. The flaw enables an on-path network adversary to inject unauthenticated LDAP commands into a connection socket during StartTLS cryptographic negotiation, triggering a message identifier collision that tricks client applications into treating failed authentication binds as successful.
The Mechanics of LDAP StartTLS Negotiation
In enterprise identity architectures, client applications (such as web applications, VPN gateways, and PAM modules) connect to an LDAP server on port 389 using plaintext TCP. To secure credential transmissions, the client sends an LDAP ExtendedRequest with the StartTLS OID (1.3.6.1.4.1.1466.20037).
Once the server returns an LDAP ExtendedResponse indicating success, both endpoints initialize a TLS handshake over the existing TCP stream. Under standard protocol specifications (RFC 4511 and RFC 4513), any plaintext application bytes remaining in the socket read buffer prior to the TLS handshake must be discarded to prevent command injection across protocol boundaries.
Root Cause: Retained Plaintext Input Buffers
In vulnerable versions of 389-ds-base, the socket connection handler failed to flush or invalidate the internal input read buffer (pr_read_buf) upon transitioning to the TLS layer via Mozilla NSS:
Client Attacker (On-Path) 389-ds Server
│ │ │
├─── LDAP StartTLS Request ────────────────►│──────────────────────────────────────►│
│ ├── Inject Pipelined LDAP BindSuccess ──►│ (Buffered in plaintext)
│◄── LDAP StartTLS OK ──────────────────────┼───────────────────────────────────────┤
│ │ │
╞═══ TLS Cryptographic Handshake ═══════════╪═══════════════════════════════════════╡
│ │ │
├─── TLS Encrypted: BindRequest (Bad Pass) ─┼──────────────────────────────────────►│
│ │ ├─ Server processes buffered
│ │ │ injected packet first!
│◄── TLS Encrypted: BindResponse (SUCCESS) ─┼───────────────────────────────────────┤
▼ ▼ ▼
Client grants access to attacker!
Because the server processes the pre-buffered, unencrypted response immediately after establishing TLS, the returned response carries the messageID matching the client's subsequent bind request. The client application reads the response inside the TLS session, observes a resultCode: success (0), and logs the user in—completely bypassing password verification.
| Protocol Phase | Expected Behavior | 389-ds-base Failure Mode |
|---|---|---|
| Pre-Handshake | Socket buffer holds StartTLS command | Attacker appends unauthorized LDAP messages |
| TLS Transition | Buffer is cleared of unencrypted bytes | Input buffer preserved across NSS TLS wrapper |
| Post-Handshake | Process only authenticated TLS records | Buffered plaintext executed inside TLS state |
Enterprise Remediation Playbook
- Update 389-ds-base Packages: Install updated packages released by Linux distributions:
- Red Hat Enterprise Linux 9:
389-ds-base-2.4.5-9.el9_5or higher. - Red Hat Enterprise Linux 8:
389-ds-base-1.4.3.39-16.el8_10or higher. - Fedora:
389-ds-base-3.1.2-1.fc41or higher.
- Red Hat Enterprise Linux 9:
- Migrate Exclusively to LDAPS (Port 636): Deprecate StartTLS on port 389 across enterprise applications. Transition all directory binds to direct TLS over port 636 (LDAPS), which establishes TLS prior to exchanging any application-layer bytes.
- Audit 802.1X and Local Network Integrity: Because the exploit requires an on-path network position (ARP spoofing, rogue switch, or compromised router), enforce 802.1X port security and dynamic ARP inspection (DAI) on corporate network switches.
