CVE-2026-19404

Name of the Vulnerable Software and Affected Versions 389 Directory Server (affected versions not specified)

Description An authorization flaw exists in the CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations. When nsslapd-allow-anonymous-access is enabled, an unauthenticated remote attacker can invoke these operations; otherwise, any authenticated low-privilege user can do so. This allows for the removal of a replica ID from replication metadata, the purging of changelog records, and the interruption of administrator-initiated cleanup, potentially leaving replication inconsistent or unavailable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.