Description

A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-10T10:17:32.250Z",
  "pubdate": "2026-08-10T10:17:32.250Z",
  "executiveSummary": "A missing authorization vulnerability has been identified in 389 Directory Server affecting the CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations.\nThis flaw allows unauthenticated remote attackers or authenticated low-privilege users to invoke critical replication-maintenance functions, depending on directory server configuration.\nSuccessful exploitation enables unauthorized removal of replica IDs from replication metadata, the premature purging of changelog records, and the interruption of administrator-initiated replication cleanups.\nThe primary impact of this vulnerability includes replication inconsistency, data synchronization failures, and denial of service regarding directory service availability.\nThe vulnerability stems from the complete absence of proper access control checks within the affected extended operations.\nExploitation requirements depend on the nsslapd-allow-anonymous-access setting; when enabled, which is the default configuration, unauthenticated remote attackers can execute the attack over the network.\nWhen anonymous access is disabled, any authenticated low-privilege user can successfully invoke the vulnerable operations.\nThe risk implications are severe for enterprise deployments relying on multi-master replication, as unauthorized state manipulation can permanently desynchronize directory replicas.",
  "technicalDetails": "The vulnerability resides in the 389 Directory Server codebase within the handling routines for the CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations.\nThe root cause of the security defect is the total lack of authorization and privilege validation checks prior to processing these administrative extended operations.\nNetwork exposure is present wherever the 389 Directory Server is accessible over LDAP or LDAPS protocols.\nAuthentication requirements vary based on server configuration: if the nsslapd-allow-anonymous-access parameter is enabled (which represents the default installation state), no authentication is required for remote threat actors to trigger the flaw.\nIf anonymous access is disabled, any standard authenticated user possessing minimal, low-privilege credentials can successfully issue the requests.\nThe step-by-step attack flow begins with the attacker establishing a network connection to the target 389 Directory Server instance.\nNext, the attacker crafts and transmits an LDAP Extended Request containing the Object Identifier (OID) associated with either the CleanAllRUV or Abort CleanAllRUV replication-maintenance operations.\nBecause the vulnerable component fails to validate the identity or administrative privileges of the request issuer, the server processes the payload immediately.\nUpon execution, the payload forces the directory server to execute replication metadata removal routines, systematically purging internal changelog records and terminating any legitimate, administrator-initiated cleanup operations currently in progress.\nThe post-exploitation impact causes severe disruption to the multi-master replication topology, leaving individual directory replicas in an inconsistent, desynchronized, or entirely unavailable state, thereby achieving a functional denial of service against the directory infrastructure."
}