Authentication Bypass in 389 Directory Server via SELFDN ACI

CVE-2026-76560 is an authentication bypass vulnerability within the 389 Directory Server. The flaw resides in the SELFDN ACI (Access Control Instruction) bind-rule evaluator, which governs access based on whether the bind DN matches a value within the directory entry. When an anonymous LDAP client provides an empty bind DN, the evaluator incorrectly matches this against an empty stored attribute value.

This logic error enables unauthenticated attackers to satisfy access control checks that are explicitly intended to be restricted to specific authenticated identities. If the directory contains entries with empty attributes targeted by a SELFDN-based ACI, an anonymous attacker can successfully perform unauthorized operations, including creating or modifying directory objects. This flaw bypasses fundamental authentication requirements, potentially leading to unauthorized data modification or administrative control over directory objects. Defenders should prioritize patching, as this vulnerability allows direct manipulation of directory contents without requiring any valid credentials.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass security policies governing SELFDN-based access control. This can result in unauthorized modification or addition of directory entries, potentially impacting the integrity and availability of identity management services dependent on 389 Directory Server.

Recommendation

Prioritize patching all instances of 389 Directory Server to the version containing the security update for CVE-2026-76560. Review existing ACI configurations to determine if SELFDN is currently in use, as environments relying on these rules for sensitive operations are at highest risk of unauthorized modifications. Monitor LDAP access logs for successful operations originating from unauthenticated (anonymous) bind requests that interact with entries typically restricted to authenticated users.