CVE-2026-86345

9 CRITICAL

Published 2026-10-02 · Updated 2026-10-07

AI risk analysis

Summary: The flaw in 389-ds-base allows an on-path attacker to inject a crafted LDAP message that can be processed after the TLS upgrade, potentially causing a client application to treat a failed authentication attempt as successful.
Exploitability: Exploitation requires an on-path attacker and the ability to inject a crafted LDAP message. Precondition is the presence of a vulnerable 389-ds-base server.
Blast radius: If exploited, this flaw can lead to unauthorized access and successful authentication bypass for client applications.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the latest version of 389-ds-base.

auth-bypassldaptls

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-923

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.