Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. (CVE-2026-94053)

CVE-2026-94053 is an authentication bypass vulnerability in the sshd-ldap component of Apache MINA SSHD, a Java SSH library. The vulnerability arises from a lack of escaping LDAP filter metacharacters in the sshd-ldap component, which is used to integrate SSH authentication with an LDAP server. This flaw allows an attacker to authenticate successfully using wildcard credentials (username "*" and password "*"). Only servers that use sshd-ldap for password or public key authentication are affected. The issue is resolved in versions 2.20.0 and 3.0.0-M6 by properly escaping LDAP filter parameters according to RFC 4515.

Successful exploitation results in authentication bypass, allowing unauthorized access to SSH servers that use the vulnerable sshd-ldap component for authentication. This can lead to full compromise of the affected SSH server without requiring valid credentials. The vulnerability has a CVSS 3.1 score of 9.1, indicating high severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Users should upgrade affected Apache MINA SSHD applications to version 2.20.0 or 3.0.0-M6 or later, which include proper escaping of LDAP filter parameters to prevent this vulnerability. If upgrading is not immediately possible, disabling the sshd-ldap component or avoiding its use for authentication can mitigate the risk. Patch status is confirmed as fixed in these versions.