CVE-2026-86345: StartTLS bypass in 389-ds-base

StartTLS in 389-ds-base allows on-path attack with LDAP injection and authentication bypass.

CVE-2026-86345 describes a critical vulnerability in LDAP server 389-ds-base during StartTLS negotiation. When the server accepts upgrade from unencrypted to TLS, it fails to discard plaintext bytes buffered by the client. An on-path attacker can inject a forged LDAP message processed after TLS upgrade: the message collides with a legitimate client operation's messageID, causing response confusion. Failed LDAP authentications can be communicated to the client as successful, opening access to protected resources.

The severity is critical: CVSS 9.0. The direct impact is LDAP authentication bypass, a critical mechanism where LDAP servers manage identities and resources in corporate environments. On-path requirement does not reduce risk in hybrid networks or cloud with weak segmentation. The technical community reported detailed analyses on 2026-11-03, consistent with NVD (2026-10-02). Active massive exploitation is not confirmed, but technical details accelerate attacker research timelines.

Administrators and security teams must act immediately: identify all 389-ds-base servers in production, contact the vendor for patch status and timeline, apply updates as soon as available. Implement network segmentation to isolate LDAP from untrusted segments, logging on failed binds followed by authorized operations, verify TLS certificate integrity during StartTLS. Where possible, disable StartTLS in favor of LDAPS connections on dedicated ports.

At a glance

What: CVE-2026-86345 concerns a flaw in StartTLS negotiation in 389-ds-base (LDAP server). During upgrade from plaintext connection to TLS, the server fails to discard plaintext bytes already buffered by the client. An on-path attacker can inject a forged LDAP message that is processed after the TLS upgrade: the response reaches the client in place of the client's own operation response, due to messageID collision. Consequence: a failed bind (authentication) can be interpreted by the client as successful.
Severity: CVSS 9.0 (critical). LDAP authentication bypass is a critical violation: LDAP servers are the central trust store for identities in corporate environments, managing access to resources, databases, and systems. The requirement for on-path positioning does not reduce risk in hybrid networks, cloud with weak segmentation, or data centers where an attacker has access to exposed segments. Technical community reports write-up on 2026-11-03, consistent with NVD (2026-10-02). Active public exploitation not confirmed.
Affected versions: not reported
Fix: not reported in NVD database. Check the 389-ds-base project on its official channels (repository, security mailing list, project website) for information on patches, release timelines, and corrected versions.
Status: Published on NVD on 2026-10-02. Social signals (technical write-up) on 2026-11-03. Active public exploitation at scale is not confirmed. The availability of detailed technical descriptions accelerates attacker research timelines.
Action: Inventory all production 389-ds-base servers. Contact vendor for patch status and timeline. Apply updates as soon as available. Implement network segmentation to isolate LDAP from untrusted segments, monitor failed binds followed by authorized operations, verify certificate integrity during StartTLS, disable StartTLS in favor of LDAPS (LDAP over TLS) on dedicated ports where possible.

Sources: NVD, CVE-2026-86345

← All articles