CVE-2026-111262 is an LDAP Injection vulnerability in the Jakarta Security LDAP identity store component of Apache TomEE. It occurs because special characters in the caller name are not neutralized before being used in LDAP directory queries. This flaw allows a remote unauthenticated attacker to manipulate LDAP queries to enumerate accounts, infer directory attribute values, or affect login validation. The issue affects only applications using the LDAP identity store. Upgrading to Apache TomEE versions 10.3.0 or 11.0.0-M2 resolves the vulnerability.
CVE-2026-17392 is a critical LDAP injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to manipulate directory queries via unsanitized user input, potentially gaining unauthorized administrative access to other tenants. This vulnerability compromises confidentiality, integrity, and availability of the affected system.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data.
CVE-2026-17214 is an LDAP injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw could allow a remote attacker to bypass security restrictions by injecting malicious LDAP queries.
SEPPmail Secure Email Gateway (SEG) versions prior to 15.1.1 contain an LDAP injection vulnerability in the GINA web interface. This flaw arises because the software does not properly neutralize LDAP metacharacters in an unauthenticated account-selection input. A remote attacker without authentication can exploit this to enumerate email addresses.
CVE-2026-93636 is an LDAP injection vulnerability in Zimbra Collaboration Suite (ZCS) versions up to 10.1.21. It allows an authenticated user to inject LDAP filter conditions via attribute names in SearchCalendarResourcesRequest, potentially exposing otherwise restricted calendar resource attributes. The vulnerability is limited to calendar-resource objects and constrained by the LDAP service account's access rights. The CVSS score is 4.3, indicating medium severity.
CVE-2026-15723 is a high-severity LDAP injection vulnerability in GitLab CE/EE affecting versions from 10.1 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. The flaw occurs when OmniAuth SAML and LDAP auto-linking are both enabled, allowing an authenticated user to take over an existing LDAP-backed account without interaction from the targeted user due to improper input sanitization in the LDAP email lookup path during OmniAuth identity linking. This issue has been fixed in GitLab versions 19.3.6, 19.4.3, and 19.5.1.
CVE-2026-93635 is an LDAP injection vulnerability in Zimbra Collaboration Suite versions up to 10.1.21. It allows unauthenticated attackers to manipulate external LDAP search filters, potentially enabling a password oracle for external directory users on domains using search-filter authentication and lazy provisioning. Authenticated S/MIME lookups may also expose certificates and identity data for unintended directory entries. The vulnerability has a medium severity with a CVSS score of 5.3.
CVE-2026-89071 is a high-severity LDAP injection vulnerability in the LDAP module of Progress MOVEit Transfer. It affects versions before 2025.1.6 and from 2026.0.0 up to but not including 2026.0.4. The vulnerability involves improper neutralization of special elements in LDAP queries, which can lead to unauthorized access or modification of data. The CVSS score is 7.5, indicating a significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. The vendor has not provided explicit patch links in the input data, so patch status should be verified with the vendor advisory.
CVE-2026-10759 is an LDAP injection vulnerability in Esri Portal for ArcGIS affecting versions up to 12.1. An authenticated administrator can supply crafted input to administrative functions that build LDAP or Active Directory search queries without proper input neutralization, potentially modifying the intended query and causing unintended directory operations. The vulnerability has a medium severity with a CVSS score of 5.5.
Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
Apache MINA SSHD is a Java library for client-side and server-side SSH.
The optional sshd-ldap component provides support for integrating
password and publickey authentication on the server side with an LDAP
server.
sshd-ldap is an optional component. SSH servers implemented with Apache
MINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of public key authentication.
Other Apache MINA SSHD servers are not affected.
Lack of escaping LDAP filter metacharacters enabled successful authentication with username "*" and password "*".
Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue by properly escaping filter parameters according to RFC 4515.
CVE-2026-90979 is an LDAP injection vulnerability in Apache Karaf affecting versions before 4.4.12. The issue arises from improper escaping of special characters in LDAP search filters constructed by LDAPCache and LDAPBackingEngine. This can allow crafted input to alter LDAP queries, potentially causing unauthorized role assignments or incorrect user account resolution. The vulnerability is exploitable through certain authentication modules that do not apply proper escaping, such as GSSAPILdapLoginModule and LDAPBackingEngine listRoles. The vulnerability has a high severity score of 7.3.
GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26.
CVE-2026-67223 is an LDAP Injection vulnerability in rabbitmq-server affecting multiple maintenance lines from 3.13 through 4.3. It arises from improper escaping of the ${username} variable in the user_dn_pattern configuration, allowing crafted usernames to alter LDAP bind DNs. Exploitation requires the rabbitmq_auth_backend_ldap plugin, a vulnerable user_dn_pattern, a directory layout that resolves the injected suffix usefully, and a valid password for the resulting DN. Fixed versions are identified but conflicting between advisory text and metadata, so exact fixed versions are not fully confirmed. The vulnerability has a medium severity with a CVSS 4.0 score of 6.3.
CVE-2026-53658 is an LDAP Injection vulnerability in Hyperledger Fabric CA versions prior to 1.5.21. When configured with an LDAP backend, the username from HTTP Basic authentication is inserted into the LDAP search filter without escaping LDAP metacharacters. This allows an unauthenticated attacker with network access to the CA enrollment endpoint to manipulate the LDAP search and potentially redirect authentication attempts to a victim account. Deployments not using an LDAP backend are not affected. The issue is fixed in version 1.5.21.
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1.
OpenAM versions prior to 16.1.1 contain an LDAP injection vulnerability in the MSISDN authentication module. This flaw allows an unauthenticated remote attacker to inject LDAP filter metacharacters due to improper escaping of user-supplied input, enabling the attacker to select arbitrary users and obtain authenticated sessions without passwords. The issue is resolved in version 16.1.1.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection.
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.
CVE-2026-75020 is an LDAP Injection vulnerability in Apache APISIX that allows a user with valid LDAP credentials to authenticate as a different consumer than intended. This affects versions from 2.11.0 through 3.17.0. The issue is fixed in version 3.18.0. The vulnerability has a high severity score of 7.0.