diff --git a/CHANGES b/CHANGES
index cebf8323f5a9ef81322cd569b343680d2b49d1c9..a38e8b0c1ba93cacf5dabac444a92368baa34f2f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -9,6 +9,7 @@ OpenLDAP 2.4.14 Engineering
 	Added slapd syncrepl default retry setting (ITS#5825)
 	Added slapd val.regex expansion (ITS#5804)
 	Added slapo-rwm newRDN rewriting (ITS#5834)
+	Fixed slapd bconfig to return error codes (ITS#5867)
 	Fixed slapd syncrepl rename handling (ITS#5809)
 	Fixed slapd syncrepl MMR when adding new server (ITS#5850)
 	Fixed slapd-ldap idassert-bind validity checking (ITS#5863)
diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c
index 0517579b88fe6d58176fca08bf9d166be100a1ce..5fa46ced536e23c588a1a3d9e692d2cc2b70edf1 100644
--- a/servers/slapd/bconfig.c
+++ b/servers/slapd/bconfig.c
@@ -3634,6 +3634,9 @@ config_send( Operation *op, SlapReply *rs, CfEntryInfo *ce, int depth )
 		rs->sr_entry = ce->ce_entry;
 		rs->sr_flags = 0;
 		rc = send_search_entry( op, rs );
+		if ( rc != LDAP_SUCCESS ) {
+			return rc;
+		}
 	}
 	if ( op->ors_scope == LDAP_SCOPE_SUBTREE ) {
 		if ( ce->ce_kids ) {
@@ -5489,20 +5492,22 @@ config_back_search( Operation *op, SlapReply *rs )
 	switch ( op->ors_scope ) {
 	case LDAP_SCOPE_BASE:
 	case LDAP_SCOPE_SUBTREE:
-		config_send( op, rs, ce, 0 );
+		rs->sr_err = config_send( op, rs, ce, 0 );
 		break;
 		
 	case LDAP_SCOPE_ONELEVEL:
 		for (ce = ce->ce_kids; ce; ce=ce->ce_sibs) {
-			config_send( op, rs, ce, 1 );
+			rs->sr_err = config_send( op, rs, ce, 1 );
+			if ( rs->sr_err ) {
+				break;
+			}
 		}
 		break;
 	}
-		
-	rs->sr_err = LDAP_SUCCESS;
+
 out:
 	send_ldap_result( op, rs );
-	return 0;
+	return rs->sr_err;
 }
 
 /* no-op, we never free entries */