CVE-2026-94053: CWE-90 Improper neutralization of special elements used in an LDAP query ('LDAP injection') in Apache Software Foundation Apache MINA SSHD
CVE-2026-94053 is a critical LDAP injection vulnerability in the sshd-ldap component of Apache MINA SSHD, affecting versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. This flaw allows authentication bypass due to improper neutralization of LDAP filter metacharacters, enabling attackers to authenticate with arbitrary credentials such as username "*" and password "*". The issue is specific to servers using the optional sshd-ldap component for password or public key authentication. Fixed versions 2.20.0 and 3.0.0-M6 properly escape LDAP filter parameters according to RFC 4515.
AI Analysis
Technical Summary
Apache MINA SSHD's optional sshd-ldap component suffers from an LDAP injection vulnerability (CWE-90) that allows authentication bypass. The vulnerability arises from failure to escape LDAP filter metacharacters in authentication queries, permitting attackers to bypass authentication controls by submitting crafted inputs such as "*" for username and password. This affects versions >=1.2.0 <2.20.0 and >=3.0.0-M1 <3.0.0-M6. The issue is resolved in versions 2.20.0 and 3.0.0-M6 by implementing proper escaping of LDAP filter parameters per RFC 4515.
Potential Impact
Successful exploitation allows an attacker to bypass authentication on SSH servers using the vulnerable sshd-ldap component, potentially granting unauthorized access with high confidentiality and integrity impact. Availability is not affected. This can lead to unauthorized access to systems relying on Apache MINA SSHD with ldap authentication enabled.
Mitigation Recommendations
Upgrade affected Apache MINA SSHD deployments using sshd-ldap to version 2.20.0 or 3.0.0-M6 or later. These versions fix the vulnerability by properly escaping LDAP filter parameters. Servers not using sshd-ldap are not affected. No other mitigation is required as the fix addresses the root cause.
CVE-2026-94053: CWE-90 Improper neutralization of special elements used in an LDAP query ('LDAP injection') in Apache Software Foundation Apache MINA SSHD
Description
CVE-2026-94053 is a critical LDAP injection vulnerability in the sshd-ldap component of Apache MINA SSHD, affecting versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. This flaw allows authentication bypass due to improper neutralization of LDAP filter metacharacters, enabling attackers to authenticate with arbitrary credentials such as username "*" and password "*". The issue is specific to servers using the optional sshd-ldap component for password or public key authentication. Fixed versions 2.20.0 and 3.0.0-M6 properly escape LDAP filter parameters according to RFC 4515.
CVSS v3.1
Score 9.1critical
Affected software
Apache Software Foundation
Apache MINA SSHD
pkg:maven/Apache Software Foundation/org.apache.sshd:sshd-ldapRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache MINA SSHD's optional sshd-ldap component suffers from an LDAP injection vulnerability (CWE-90) that allows authentication bypass. The vulnerability arises from failure to escape LDAP filter metacharacters in authentication queries, permitting attackers to bypass authentication controls by submitting crafted inputs such as "*" for username and password. This affects versions >=1.2.0 <2.20.0 and >=3.0.0-M1 <3.0.0-M6. The issue is resolved in versions 2.20.0 and 3.0.0-M6 by implementing proper escaping of LDAP filter parameters per RFC 4515.
Potential Impact
Successful exploitation allows an attacker to bypass authentication on SSH servers using the vulnerable sshd-ldap component, potentially granting unauthorized access with high confidentiality and integrity impact. Availability is not affected. This can lead to unauthorized access to systems relying on Apache MINA SSHD with ldap authentication enabled.
Mitigation Recommendations
Upgrade affected Apache MINA SSHD deployments using sshd-ldap to version 2.20.0 or 3.0.0-M6 or later. These versions fix the vulnerability by properly escaping LDAP filter parameters. Servers not using sshd-ldap are not affected. No other mitigation is required as the fix addresses the root cause.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-19T22:33:01.194Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abce0dc0df196e1a9de7077
Added to database: 09/30/2026, 10:13:48 UTC
Last enriched: 09/30/2026, 10:27:04 UTC
Last updated: 09/30/2026, 10:44:16 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.