CVE-2026-19271 is an LDAP Injection vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute's Liderahenk product. It affects versions from 3.4.0 up to but not including 3.5.5. The vulnerability involves improper neutralization of special elements in LDAP queries, which can lead to unauthorized information disclosure. The CVSS score is 7.5, indicating a high severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
Fabric CA versions prior to 1.5.21, when configured with an LDAP backend, are vulnerable to LDAP injection due to unescaped usernames in the LDAP UserFilter during authentication. This allows an unauthenticated attacker with network access to manipulate LDAP searches before password validation, potentially redirecting authentication attempts to victim accounts. Deployments not using LDAP backends are not affected. The issue is fixed in version 1.5.21.
CVE-2026-59652 is an LDAP injection vulnerability in the Bouncy Castle for Java library (BC-JAVA) affecting versions before 1.85. The issue occurs in the legacy jdk1.4 LDAPStoreHelper component, where improper neutralization of special elements in LDAP queries allows injection. This vulnerability has a medium severity with a CVSS score of 6.9.
Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0 contain an LDAP injection vulnerability due to improper escaping of special characters in LDAP search filters. This vulnerability is an incomplete fix of a previous issue (CVE-2024-31867). The issue is resolved in version 0.12.1. The CVSS score is 6.5, indicating a medium severity risk.
Apache Zeppelin versions 0.6.0 through 0.12.0 contain an LDAP injection vulnerability in the ActiveDirectoryGroupRealm component. This flaw allows an authenticated attacker to inject LDAP filter syntax via the user-search endpoint and potentially expose directory information. The role-lookup path is also affected after successful LDAP authentication. The issue is fixed in version 0.12.1.
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection.
This issue affects PassGate: through 30042026.
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection.
This issue affects Liman MYS: before release.Master.1107.
# Vulnerability
`SearchFirstActiveDirectoryRealm.findUserDn()` substitutes the user-supplied username from the login form into an LDAP search filter template (default `cn={0}`) **without escaping RFC 4515 filter metacharacters** (`*`, `(`, `)`, `\`, NUL). Combined with `SearchControls.setCountLimit(1)` on the same call site, this allows three distinct attack primitives:
1. **Authentication confusion** — typing username `*` causes the realm to construct filter `cn=*`, return the first directory entry (typically a privileged account in AD ordering), and attempt bind against that DN with the attacker's password.
2. **Audit log evasion** — payload `bob)(uid=alice` is recorded verbatim in audit logs while the realm searches with the malformed filter, breaking accountability/compliance (SOX, PCI-DSS, ISO 27001).
3. **Directory enumeration** — wildcards and timing differences allow reconnaissance of OU structure and admin group membership.
A repo-wide search for any LDAP escape helper (`escapeLdap`, `encodeFilter`, `escapeFilter`, `ldapEscape`) returns **zero hits** — the defense is not just missing, it was never added.
> **Applicability note:** This realm is opt-in. The shipped default LDAP example (`dist/src/conf/shiro.example.ldap.ini`) uses Shiro's `DefaultLdapRealm` with `userDnTemplate` and is **NOT** affected. However, the realm exists precisely to support Active Directory environments where users log in via `sAMAccountName` and the realm must search for the DN first — the canonical LINE corporate AD-backed SSO scenario. Internal deployments using AD-backed login almost certainly select this realm.
---
## Evidence
**File:** `server-auth/shiro/src/main/java/com/linecorp/centraldogma/server/auth/shiro/realm/SearchFirstActiveDirectoryRealm.java`
**Lines 148–176** on branch `main` @ commit `d64a5151`:
```java
@Nullable
protected String findUserDn(LdapContextFactory ldapContextFactory, String username)
throws NamingException {
LdapContext ctx = null;
try {
ctx = ldapContextFactory.getSystemLdapContext();
final SearchControls ctrl = new SearchControls();
ctrl.setCountLimit(1); // line 156 — returns FIRST match only
ctrl.setSearchScope(SearchControls.SUBTREE_SCOPE);
ctrl.setTimeLimit(searchTimeoutMillis);
final String filter =
searchFilter != null ? USERNAME_PLACEHOLDER.matcher(searchFilter)
.replaceAll(username) // line 162 — RAW SUBSTITUTION
: username; // line 163
final NamingEnumeration result = ctx.search(searchBase, filter, ctrl);
...
```
`USERNAME_PLACEHOLDER = Pattern.compile("\\{0}")`. Default `searchFilter = "cn={0}"`.
### Data flow from HTTP login to vulnerable substitution
| Step | Component |
|------|-----------|
| HTTP login form | `POST /api/v1/login` form field `username` |
| `ShiroLoginService.usernamePassword()` (lines 198–223) | applies `loginNameNormalizer` (Unicode lowercase only — **NOT** LDAP escape) |
| `Subject.login(new UsernamePasswordToken(username, password))` | Shiro hand-off |
| `ActiveDirectoryRealm.doGetAuthenticationInfo` (Shiro core) | calls `queryForAuthenticationInfo0` |
| `SearchFirstActiveDirectoryRealm.findUserDn(factory, upToken.getUsername())` | username flows in **verbatim** |
### Repository-wide escape helper grep
| Search term | Hits |
|-------------|------|
| `escapeLdap` | 0 |
| `encodeFilter` | 0 |
| `escapeFilter` | 0 |
| `ldapEscape` | 0 |
---
## PoC
Self-contained JUnit 5 test using UnboundID `InMemoryDirectoryServer` (in-process, no external LDAP required). Drop into `server-auth/shiro/src/test/java/com/linecorp/centraldogma/server/auth/shiro/realm/LdapInjectionPoCTest.java` and add `com.unboundid:unboundid-ldapsdk:7.0.0` as a test dependency.
> The PoC works by subclassing the realm and overriding `findUserDn()` to capture the actual LDAP filter string sent to the directory — the captured filter is the structural evidence, independent of LDAP server strictness about bind outcomes.
```java
/*
* Copyright 2026 LINE Corporation
*
* SECURITY PoC — NOT FOR MERGE INTO THE MAIN TEST SUITE.
*
* This JUnit class demonstrates the LDAP filter injection in
* SearchFirstActiveDirectoryRealm. Drop into
* server-auth/shiro/src/test/java/com/linecorp/centraldogma/server/auth/shiro/realm/
* Adds the UnboundID LDAP SDK as a test dep.
*/
package com.linecorp.centraldogma.server.auth.shiro.realm;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatThrownBy;
import javax.naming.directory.SearchControls;
import javax.naming.ldap.LdapContext;
import org.apache.shiro.realm.ldap.JndiLdapContextFactory;
import org.apache.shiro.realm.ldap.LdapContextFactory;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.BeforeAll;
CVE-2026-49268 is a high-severity LDAP injection vulnerability in Apache Shiro's DefaultLdapRealm class. It allows remote attackers to inject LDAP special characters into the Distinguished Name (DN) construction by concatenating user-supplied usernames without proper escaping. This can lead to manipulation of the LDAP DN used for bind authentication, potentially enabling authentication bypass or user impersonation. The vulnerability affects all Apache Shiro versions through 2.2.0 and 3.0.0-alpha-1 when using DefaultLdapRealm. Upgrading to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later addresses the issue.
Apache Airflow FAB Auth Manager has an LDAP injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. This affects versions prior to 3.6.4 of the apache-airflow-providers-fab package. The vulnerability has a medium severity with a CVSS score of 5.3. Users are advised to upgrade to version 3.6.4 or later. If upgrading immediately is not possible, disabling LDAP authentication is recommended until the provider is updated.
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.
Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.06.
Users are recommended to upgrade to version 24.09.06, which fixes the issue.
ZITADEL versions from 2.71.11 up to but not including 3.4.10, and from 4.0.0 up to but not including 4.15.0, contain an LDAP Injection vulnerability in the LDAP identity provider implementation. This flaw allows unauthenticated attackers to inject LDAP filter metacharacters during login, enabling blind LDAP injection attacks. Attackers can enumerate valid usernames and extract sensitive LDAP directory attributes. The vulnerability does not permit full authentication bypass. Fixed in versions 3.4.10 and 4.15.0.
Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.
CVE-2026-40606 is an LDAP injection vulnerability in mitmproxy versions 12.2.1 and below. The issue occurs because the builtin LDAP proxy authentication does not properly sanitize usernames when querying the LDAP server, allowing a malicious client to bypass authentication. This vulnerability affects only mitmproxy instances that have the proxyauth option enabled with LDAP, which is not enabled by default. The vulnerability is fixed in mitmproxy version 12.2.2 and later.
maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the go-ldap/ldap/v3 library's ldap.EscapeFilter() function being available in the same import. This affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths. This issue has been fixed in version 0.9.3.
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules).
This vulnerability is associated with program files LDAPStoreHelper.
This issue affects BC-JAVA: from 1.74 before 1.80.2, from 1.81 before 1.81.1, from 1.82 before 1.84.
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters into the username field of the WebGUI login page to enumerate valid LDAP usernames in the configured directory. When the LDAP server configuration includes an Extended Query to restrict login to members of a specific group, the same injection can be used to bypass that group membership restriction and authenticate as any LDAP user whose password is known, regardless of group membership. This vulnerability is fixed in 26.1.6.
CVE-2026-29138 is a medium severity LDAP injection vulnerability in SEPPmail Secure Email Gateway versions before 15.0.3. It allows attackers who craft a specially formed email address to impersonate another user's PGP signature. This improper neutralization of special elements in LDAP queries can lead to unauthorized claim of PGP signatures. No patch information is provided in the available data.