important · Remote code execution
A delegated LDAP administrator can plant a distinguished name that Cockpit later executes as root.
Affects
Red Hat Directory Server deployments that include Cockpit 389 Console, the web administration interface for the LDAP directory server on Linux.
The chain requires a separate privileged operator to view the entry, after which Cockpit embeds the unescaped name in a shell command executed through its superuser channel.