Medium [CVE-2026-18651] SASL PLAIN bind installs connection credentials before account-lock check, allowing continued access as a locked account
This medium-severity Red Hat Linux advisory covers CVE-2026-18651 affecting Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Directory Server 13.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check.
If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted.
A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.
This flaw lets a user authenticate to an already-locked account (nsAccountLock: true) via SASL PLAIN, using that account's own correct password. The server checks the password before it checks the lock, so the connection becomes authenticated even though the client is told the bind failed.
After bind, the user can read and modify what that account was already permitted to touch - no escalation and access beyond it's own rights. Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Weakness: CWE-287. Affected Red Hat products: Red Hat Directory Server 11; Red Hat Directory Server 12; Red Hat Directory Server 13; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Red Hat lists Red Hat Enterprise Linux 6 as not affected.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 26 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 26 days ago·verify at source
Mitigation checklist
- When locking an account, also rotate its LDAP password. Locking the account alone is not enough: this flaw lets a bind with the account's still-valid password succeed even after it's locked.
Official advisory · high-confidence parse· fetched 26 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.