Command Injection in 389 Directory Server Cockpit Console

CVE-2026-19843 describes a critical command injection vulnerability in the 389 Directory Server's Cockpit 389 Console. The flaw stems from improper sanitization of LDAP entry distinguished names (DNs) when the console constructs and executes ldapsearch commands. An attacker who has been delegated the authority to create or rename entries within the LDAP directory can inject arbitrary shell metacharacters into an entry's DN. When an administrator later logs into the Cockpit 389 Console and navigates to the view containing the malicious entry, the console's background process triggers the injection. Because the Cockpit 389 process operates with elevated permissions, the resulting command execution occurs with root privileges on the directory server host. This vulnerability effectively allows an attacker with low-level administrative access to escalate privileges to full system compromise.

Attack Chain

1. Attacker obtains delegated LDAP write permissions for the target directory instance.
2. Attacker crafts a malicious Distinguished Name (DN) containing shell metacharacters such as backticks, semicolons, or pipe operators.
3. Attacker uses LDAP administrative tools to create or rename an existing entry using the crafted malicious DN.
4. Attacker waits for a system administrator to open the 389 Directory Server instance in the Cockpit 389 Console.
5. The console interface iterates through directory entries and automatically executes a backend ldapsearch call using the malicious DN string.
6. The underlying shell interprets the injected metacharacters within the ldapsearch command string.
7. The system executes the injected payload as root, granting the attacker arbitrary code execution on the directory server host.

Impact

Successful exploitation results in full system compromise of the 389 Directory Server host, as the injected commands execute with root-level privileges. This enables attackers to exfiltrate the entire directory database, modify security credentials, install backdoors, or facilitate lateral movement within the network. The scope of impact is limited to organizations deploying 389 Directory Server with the Cockpit 389 Console management interface enabled.

Recommendation

1. Audit existing LDAP entries for suspicious characters or unusually long strings in the 'distinguishedName' attribute using standard administrative tools.
2. Implement strict input validation on LDAP entry naming conventions to prevent the insertion of shell metacharacters.
3. Restrict delegation of entry creation or renaming privileges to a strictly controlled, minimal set of trusted users.
4. Upgrade 389 Directory Server and Cockpit 389 components to the patched version once released by the vendor.
5. Monitor host process-creation logs for ldapsearch executions spawned by the Cockpit management user or web server process that contain suspicious shell arguments.