Common Weakness Enumeration

CWE-90

Allowed

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Abstraction: Base · Status: Draft

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

138 vulnerabilities reference this CWE, most recent first.

GHSA-2P3Q-H3HG-JCQQ

Vulnerability from github – Published: 2026-07-21 16:07 – Updated: 2026-07-21 16:07

Summary

Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability

Details

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core Negotiate Authentication (Microsoft.AspNetCore.Authentication.Negotiate). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An elevation of privilege vulnerability exists in the ASP.NET Core Negotiate authentication handler in .NET 8, .NET 9, and .NET 10 due to improper parsing.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/TBD

CVSS Details

Version: 3.1
Severity: High
Score: 8.8
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-302 (Authentication Bypass by Assumed-Immutable Data), CWE-863 (Incorrect Authorization), CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))

Affected Platforms

Platforms: All
Architectures: All

Affected Packages

The vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below

.NET 10

Package name	Affected version	Patched version
Microsoft.AspNetCore.Authentication.Negotiate	>= 10.0.0, <= 10.0.9	10.0.10

.NET 9

Package name	Affected version	Patched version
Microsoft.AspNetCore.Authentication.Negotiate	>= 9.0.0, <= 9.0.17	9.0.18

.NET 8

Package name	Affected version	Patched version
Microsoft.AspNetCore.Authentication.Negotiate	>= 8.0.0, <= 8.0.28	8.0.29

Advisory FAQ

How do I know if I am affected?

If using a package listed in affected packages, you're exposed to the vulnerability.

How do I fix the issue?

To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
If your application references the vulnerable nuget package, update the package reference to the patched version. You can list the versions you have installed by running the dotnet --info command.

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-47303

Acknowledgements

Pham Quang Minh

Revisions

V1.0 (July 14, 2026): Advisory published.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.Authentication.Negotiate"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0"
            },
            {
              "fixed": "10.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.17"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.Authentication.Negotiate"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.28"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.Authentication.Negotiate"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.29"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47303"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-302",
      "CWE-863",
      "CWE-90"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T16:07:53Z",
    "nvd_published_at": "2026-07-14T19:17:08Z",
    "severity": "HIGH"
  },
  "details": "## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core Negotiate Authentication (Microsoft.AspNetCore.Authentication.Negotiate). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nAn elevation of privilege vulnerability exists in the ASP.NET Core Negotiate authentication handler in .NET 8, .NET 9, and .NET 10 due to improper parsing.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/**TBD**\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`\n- **Weakness:** CWE-302 (Authentication Bypass by Assumed-Immutable Data), CWE-863 (Incorrect Authorization), CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027))\n\n## Affected Platforms\n\n- **Platforms:** All\n- **Architectures:** All\n\n## \u003ca name=\"affected-packages\"\u003e\u003c/a\u003eAffected Packages\nThe vulnerability affects any Microsoft .NET project if it uses any of affected package versions listed below\n\n### \u003ca name=\".NET 10\"\u003e\u003c/a\u003e.NET 10\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.Authentication.Negotiate](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.Negotiate)               | \u003e= 10.0.0, \u003c= 10.0.9 | 10.0.10\n\n### \u003ca name=\".NET 9\"\u003e\u003c/a\u003e.NET 9\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.Authentication.Negotiate](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.Negotiate)               | \u003e= 9.0.0, \u003c= 9.0.17 | 9.0.18\n\n### \u003ca name=\".NET 8\"\u003e\u003c/a\u003e.NET 8\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.Authentication.Negotiate](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.Negotiate)               | \u003e= 8.0.0, \u003c= 8.0.28 | 8.0.29\n\n## Advisory FAQ\n\n### \u003ca name=\"how-affected\"\u003e\u003c/a\u003eHow do I know if I am affected?\n\nIf using a package listed in [affected packages](#affected-packages), you\u0027re exposed to the vulnerability.\n\n### \u003ca name=\"how-fix\"\u003e\u003c/a\u003eHow do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n2. If your application references the vulnerable nuget package, update the package reference to the patched version. You can list the versions you have installed by running the `dotnet --info` command.\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you\u0027ve deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-47303]( https://www.cve.org/CVERecord?id=CVE-2026-47303)\n\n### Acknowledgements\n\nPham Quang Minh\n\n### Revisions\n\nV1.0 (July 14, 2026): Advisory published.",
  "id": "GHSA-2p3q-h3hg-jcqq",
  "modified": "2026-07-21T16:07:53Z",
  "published": "2026-07-21T16:07:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/aspnetcore/security/advisories/GHSA-2p3q-h3hg-jcqq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47303"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/announcements/issues/411"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dotnet/aspnetcore"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/aspnetcore/discussions/67786"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47303"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Microsoft Security Advisory CVE-2026-47303 \u2013 .NET Elevation of Privilege Vulnerability"
}

GHSA-2X9H-H3C4-WQQH

Vulnerability from github – Published: 2022-05-14 01:00 – Updated: 2024-03-12 14:24

Summary

Improper Neutralization of Special Elements used in an LDAP Query in Jenkins

Details

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

Severity

9.8 (Critical)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.31"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.main:jenkins-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.20"
            },
            {
              "fixed": "2.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.19.2"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.main:jenkins-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.19.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-9299"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-90"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T19:50:21Z",
    "nvd_published_at": "2017-01-12T23:59:00Z",
    "severity": "CRITICAL"
  },
  "details": "The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.",
  "id": "GHSA-2x9h-h3c4-wqqh",
  "modified": "2024-03-12T14:24:42Z",
  "published": "2022-05-14T01:00:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9299"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/jenkins/commit/6078dd7aa097baf3402de9d5279f6053926a1ea7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/jenkins/commit/ce8a2d51a5ee9ca12d0a75659b06161888e0a1bf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/jenkins/commit/d84d9a2ad3825f316f805a18b3654b0803e0d7fc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/jenkins/commit/f574224cae5ffde2bc4c996305c0dcf5ab135440"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/jenkins/commit/fde9c42fe05ac925a904b6c09a81d497d0e6ccea"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/jenkins"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/forum/#!original/jenkinsci-advisories/-fc-w9tNEJE/GRvEzWoJBgAJ"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/forum/#!original/jenkinsci-advisories/-fc-w9tNEJE/LZ7EOS0fBgAJ"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZW2KUKYLNLVDB7STLHLYALCUFLEGCRM6"
    },
    {
      "type": "WEB",
      "url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16"
    },
    {
      "type": "WEB",
      "url": "https://www.cloudbees.com/jenkins-security-advisory-2016-11-16"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/44642"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/11/12/4"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/11/14/9"
    },
    {
      "type": "WEB",
      "url": "http://www.slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Neutralization of Special Elements used in an LDAP Query in Jenkins"
}

GHSA-3322-WPC2-P4M7

Vulnerability from github – Published: 2026-03-27 09:31 – Updated: 2026-03-27 09:31

Details

If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-27860"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-90"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-27T09:16:20Z",
    "severity": "LOW"
  },
  "details": "If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot\u0027s LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.",
  "id": "GHSA-3322-wpc2-p4m7",
  "modified": "2026-03-27T09:31:19Z",
  "published": "2026-03-27T09:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27860"
    },
    {
      "type": "WEB",
      "url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3JQF-V4MV-747G

Vulnerability from github – Published: 2026-01-22 18:06 – Updated: 2026-01-23 15:49

Summary

Moonraker affected by LDAP search filter injection

Details

Impact

Instances of Moonraker configured with the ldap component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes.

Patches

Users should upgrade to Moonraker 0.10.0 which patches this vulnerability.

Workarounds

Admins can set the max_login_attempts option in the [authorization] section to a reasonable value. Any IP attempting to exploit this vulnerability will be locked out after it has reached the specified number of consecutive failed login attempts. This condition is cleared after a Moonraker restart. Note that if an attacker knows a valid user password they can bypass this protection by successfully logging in.

The most secure workaround for users unable to upgrade is to remove the ldap section from moonraker.conf and rely on the built in user authentication.

Severity

2.7 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "moonraker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-24130"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-90"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-22T18:06:54Z",
    "nvd_published_at": "2026-01-22T23:15:58Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nInstances of Moonraker configured with the `ldap` component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint.   The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes.\n\n### Patches\n\nUsers should upgrade to Moonraker 0.10.0 which patches this vulnerability.\n\n### Workarounds\n\nAdmins can set the `max_login_attempts` option in the `[authorization]` section to a reasonable value.    Any IP attempting to exploit this vulnerability will be locked out after it has reached the specified number of consecutive failed login attempts.  This condition is cleared after a Moonraker restart.   Note that if an attacker knows a valid user password they can bypass this protection by successfully logging in.\n\nThe most secure workaround for users unable to upgrade is to remove the `ldap` section from `moonraker.conf` and rely on the built in user authentication.",
  "id": "GHSA-3jqf-v4mv-747g",
  "modified": "2026-01-23T15:49:23Z",
  "published": "2026-01-22T18:06:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Arksine/moonraker/security/advisories/GHSA-3jqf-v4mv-747g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24130"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Arksine/moonraker/commit/74c5d8e44c4a4abbfbb06fb991e7ebb9ac947f42"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Arksine/moonraker"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Moonraker affected by LDAP search filter injection"
}

GHSA-3JRJ-7493-FGQ2

Vulnerability from github – Published: 2026-04-17 15:31 – Updated: 2026-04-20 15:31

Details

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations.

This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-40459"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-90"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-17T14:16:34Z",
    "severity": "HIGH"
  },
  "details": "PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations.\n\nThis issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1",
  "id": "GHSA-3jrj-7493-fgq2",
  "modified": "2026-04-20T15:31:52Z",
  "published": "2026-04-17T15:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40459"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2026/04/CVE-2026-40458"
    },
    {
      "type": "WEB",
      "url": "https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-3R34-VQ8M-39GH

Vulnerability from github – Published: 2026-05-06 19:16 – Updated: 2026-05-13 16:41

Summary

Lemur: LDAP Filter Injection enables post-authentication privilege escalation

Details

Description

Overview

Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator.

Vulnerable Code

Location: lemur/auth/ldap.py, _bind() method

Filter 1 — User lookup (line ~161):

ldap_filter = "userPrincipalName=%s" % self.ldap_principal

self.ldap_principal is derived directly from args["username"] submitted at POST /auth/login with no sanitization. The ldap.filter.escape_filter_chars() function is never called.

Filter 2 — Active Directory group lookup (line ~189):

groupfilter = "(&(objectclass=group)(member:1.2.840.113556.1.4.1941:={}))".format(userdn)

The userdn value is derived from the LDAP response to the first unsanitized query, making it potentially tainted as well.

Impact

An authenticated LDAP user can:

Inject LDAP filter syntax into the username field during login
Manipulate the group membership query to return arbitrary groups
Be assigned the admin role or any other privileged role in Lemur
Gain unauthorized access to all certificates, private keys (via /certificates/<id>/key), and CA configurations
Issue certificates under any authority

Exploitation Constraint

The simple_bind_s() call must succeed before the injectable filter is reached, so the attacker requires valid LDAP credentials. This is a post-authentication privilege escalation.

Steps to Reproduce

Deploy Lemur with LDAP authentication enabled: python LDAP_AUTH = True LDAP_IS_ACTIVE_DIRECTORY = True LDAP_BIND_URI = "ldaps://dc.corp.example.com" LDAP_BASE_DN = "DC=corp,DC=example,DC=com" LDAP_EMAIL_DOMAIN = "corp.example.com"
Create a valid LDAP user account
Send login request with crafted username containing LDAP metacharacters: ``` POST /auth/login Content-Type: application/json

{ "username": "validuser)(memberOf=CN=LemurAdmins,DC=corp,DC=example,DC=com", "password": "validpassword" } 4. The LDAP filter becomes: userPrincipalName=validuser)(memberOf=CN=LemurAdmins,DC=corp,DC=example,DC=com@corp.example.com ``` 5. Depending on the LDAP server's parsing, this can alter query semantics 6. The user is assigned roles they should not have access to

Remediation

Apply ldap.filter.escape_filter_chars() to all user-controlled values before interpolation:

from ldap.filter import escape_filter_chars

# Fix 1: User lookup filter
ldap_filter = "userPrincipalName=%s" % escape_filter_chars(self.ldap_principal)

# Fix 2: Active Directory group filter
groupfilter = "(&(objectclass=group)(member:1.2.840.113556.1.4.1941:={}))".format(
    escape_filter_chars(userdn)
)

Resources

CWE-90: https://cwe.mitre.org/data/definitions/90.html
OWASP LDAP Injection: https://owasp.org/www-community/attacks/LDAP_Injection
Python ldap.filter.escape_filter_chars: https://www.python-ldap.org/en/python-ldap-3.4.0/reference/ldap-filter.html

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "lemur"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44304"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-90"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T19:16:59Z",
    "nvd_published_at": "2026-05-12T22:16:37Z",
    "severity": "HIGH"
  },
  "details": "## Description\n\n### Overview\n\nLemur\u0027s LDAP authentication module (`lemur/auth/ldap.py`) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator.\n\n### Vulnerable Code\n\n**Location:** `lemur/auth/ldap.py`, `_bind()` method\n\n**Filter 1 \u2014 User lookup (line ~161):**\n```python\nldap_filter = \"userPrincipalName=%s\" % self.ldap_principal\n```\n\n`self.ldap_principal` is derived directly from `args[\"username\"]` submitted at `POST /auth/login` with no sanitization. The `ldap.filter.escape_filter_chars()` function is never called.\n\n**Filter 2 \u2014 Active Directory group lookup (line ~189):**\n```python\ngroupfilter = \"(\u0026(objectclass=group)(member:1.2.840.113556.1.4.1941:={}))\".format(userdn)\n```\n\nThe `userdn` value is derived from the LDAP response to the first unsanitized query, making it potentially tainted as well.\n\n### Impact\n\nAn authenticated LDAP user can:\n\n1. Inject LDAP filter syntax into the username field during login\n2. Manipulate the group membership query to return arbitrary groups\n3. Be assigned the `admin` role or any other privileged role in Lemur\n4. Gain unauthorized access to all certificates, private keys (via `/certificates/\u003cid\u003e/key`), and CA configurations\n5. Issue certificates under any authority\n\n### Exploitation Constraint\n\nThe `simple_bind_s()` call must succeed before the injectable filter is reached, so the attacker requires valid LDAP credentials. This is a **post-authentication privilege escalation**.\n\n### Steps to Reproduce\n\n1. Deploy Lemur with LDAP authentication enabled:\n   ```python\n   LDAP_AUTH = True\n   LDAP_IS_ACTIVE_DIRECTORY = True\n   LDAP_BIND_URI = \"ldaps://dc.corp.example.com\"\n   LDAP_BASE_DN = \"DC=corp,DC=example,DC=com\"\n   LDAP_EMAIL_DOMAIN = \"corp.example.com\"\n   ```\n2. Create a valid LDAP user account\n3. Send login request with crafted username containing LDAP metacharacters:\n   ```\n   POST /auth/login\n   Content-Type: application/json\n\n   {\n     \"username\": \"validuser)(memberOf=CN=LemurAdmins,DC=corp,DC=example,DC=com\",\n     \"password\": \"validpassword\"\n   }\n   ```\n4. The LDAP filter becomes:\n   ```\n   userPrincipalName=validuser)(memberOf=CN=LemurAdmins,DC=corp,DC=example,DC=com@corp.example.com\n   ```\n5. Depending on the LDAP server\u0027s parsing, this can alter query semantics\n6. The user is assigned roles they should not have access to\n\n### Remediation\n\nApply `ldap.filter.escape_filter_chars()` to all user-controlled values before interpolation:\n\n```python\nfrom ldap.filter import escape_filter_chars\n\n# Fix 1: User lookup filter\nldap_filter = \"userPrincipalName=%s\" % escape_filter_chars(self.ldap_principal)\n\n# Fix 2: Active Directory group filter\ngroupfilter = \"(\u0026(objectclass=group)(member:1.2.840.113556.1.4.1941:={}))\".format(\n    escape_filter_chars(userdn)\n)\n```\n\n### Resources\n\n- CWE-90: https://cwe.mitre.org/data/definitions/90.html\n- OWASP LDAP Injection: https://owasp.org/www-community/attacks/LDAP_Injection\n- Python ldap.filter.escape_filter_chars: https://www.python-ldap.org/en/python-ldap-3.4.0/reference/ldap-filter.html",
  "id": "GHSA-3r34-vq8m-39gh",
  "modified": "2026-05-13T16:41:43Z",
  "published": "2026-05-06T19:16:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Netflix/lemur/security/advisories/GHSA-3r34-vq8m-39gh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44304"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Netflix/lemur"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Netflix/lemur/releases/tag/v1.9.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Lemur: LDAP Filter Injection enables post-authentication privilege escalation"
}

GHSA-44VJ-XC6R-J6M3

Vulnerability from github – Published: 2026-07-07 12:31 – Updated: 2026-07-07 12:31

Details

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection.

This issue affects Liman MYS: before release.Master.1107.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-13696"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-90"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-07T12:16:32Z",
    "severity": "HIGH"
  },
  "details": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection.\n\nThis issue affects Liman MYS: before release.Master.1107.",
  "id": "GHSA-44vj-xc6r-j6m3",
  "modified": "2026-07-07T12:31:37Z",
  "published": "2026-07-07T12:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13696"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0504"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4GR5-536M-W65F

Vulnerability from github – Published: 2022-05-24 16:56 – Updated: 2024-04-04 01:59

Details

Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance creation, facilitating the malicious space developer to deny service or perform a dictionary attack.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-11277"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-90"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-09-23T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance creation, facilitating the malicious space developer to deny service or perform a dictionary attack.",
  "id": "GHSA-4gr5-536m-w65f",
  "modified": "2024-04-04T01:59:15Z",
  "published": "2022-05-24T16:56:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11277"
    },
    {
      "type": "WEB",
      "url": "https://www.cloudfoundry.org/blog/cve-2019-11277"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4P4P-22CR-2GQW

Vulnerability from github – Published: 2024-01-08 09:30 – Updated: 2024-01-08 09:30

Details

The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP query. No publicly available exploits are known.

Severity

7.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-29050"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-90"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-08T09:15:20Z",
    "severity": "HIGH"
  },
  "details": "The optional \"LDAP contacts provider\" could be abused by privileged users to inject LDAP filter strings that allow to access content outside of the intended hierarchy. Unauthorized users could break confidentiality of information in the directory and potentially cause high load on the directory server, leading to denial of service. Encoding has been added for user-provided fragments that are used when constructing the LDAP query. No publicly available exploits are known.\n\n",
  "id": "GHSA-4p4p-22cr-2gqw",
  "modified": "2024-01-08T09:30:35Z",
  "published": "2024-01-08T09:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29050"
    },
    {
      "type": "WEB",
      "url": "https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0005.json"
    },
    {
      "type": "WEB",
      "url": "https://documentation.open-xchange.com/security/advisories/csaf/oxas-adv-2023-0005.json"
    },
    {
      "type": "WEB",
      "url": "https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6248_7.10.6_2023-09-19.pdf"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/176421/OX-App-Suite-7.10.6-XSS-Command-Execution-LDAP-Injection.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jan/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4R67-4X4P-FPRG

Vulnerability from github – Published: 2025-06-11 12:30 – Updated: 2025-06-11 15:44

Summary

Mattermost allows authenticated administrator to execute LDAP search filter injection

Details

Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.

Severity

4.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost/server/v8"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.0-20250414112942-77892234944b"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.7.0"
            },
            {
              "fixed": "10.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.6.0"
            },
            {
              "fixed": "10.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.5.0"
            },
            {
              "fixed": "10.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/mattermost/mattermost-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.11.0"
            },
            {
              "fixed": "9.11.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-4573"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-90"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-11T15:44:17Z",
    "nvd_published_at": "2025-06-11T11:15:23Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost versions 10.7.x \u003c= 10.7.1, 10.6.x \u003c= 10.6.3, 10.5.x \u003c= 10.5.4, 9.11.x \u003c= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.",
  "id": "GHSA-4r67-4x4p-fprg",
  "modified": "2025-06-11T15:44:17Z",
  "published": "2025-06-11T12:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4573"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/1f9c688a30847eeb7bfb1574dc7bbb9f011afbf7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/64a65c6107877382040297b3ef215c689caaed74"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/77892234944bc7476b20794e516538bcac717de9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/b33926709b956a59558cc7fef80c0e75a769ce81"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mattermost/mattermost/commit/b47e89c4f98cb6ad9f1dceb79325aa94e80f963a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mattermost/mattermost"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mattermost allows authenticated administrator to execute LDAP search filter injection"
}

Mitigation MIT-5

Implementation

Strategy: Input Validation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

CAPEC-136: LDAP Injection

An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value.

← Back to the CWE list