CVE-2026-18651 Auth bypass in Red Hat Directory Server 11

Medium 5.4 Published 3 Aug 2026 Updated 3 Aug 2026

Attackers with valid credentials for locked accounts can bypass account lockout controls and maintain access due to improper state handling during SASL PLAIN authentication.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-18651?

CVE-2026-18651 is a medium-severity authentication bypass vulnerability in Redhat Enterprise Linux, published on 3 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.

Weakness: CWE-287

Which versions are affected by CVE-2026-18651?

It affects 3 products.

Products include Redhat 389 Directory Server, Redhat Directory Server, Redhat Enterprise Linux.

How do I fix CVE-2026-18651?

No fix has been published for CVE-2026-18651 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-18651 being exploited?

There is no known exploitation of CVE-2026-18651 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as AZL-94517, DEBIAN-CVE-2026-18651, GHSA-q924-9ph6-5h92, UBUNTU-CVE-2026-18651.