Netatalk CVE-2026-44052

Exploitation requires (1) the Netatalk deployment to be configured to authenticate users against an LDAP directory using simple-bind (non-default for many installs that rely on local PAM/UAM or Kerberos), (2) the attacker to obtain read access to Netatalk's log output - local filesystem access to the log files, access to a downstream syslog/SIEM index, or possession of log backups - and (3) at least one LDAP simple-bind event to have been logged after the vulnerable code path was exercised. The CVSS AV:N rating reflects the network-classification of LDAP credential disclosure impact rather than direct remote retrieval of the log, so realistic risk is gated by who can read the logs; environments without LDAP simple-bind configured are not affected even on vulnerable Netatalk versions.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N rates this network-reachable and unauthenticated with high confidentiality impact, but in practice the 'network' vector is misleading for a log-disclosure bug - actual exploitation requires the attacker to obtain the log content (local file read, log-aggregation access, backup theft, or a separate log-exposing vulnerability), so AV:N overstates direct reachability and the true risk is closer to a local/adjacent disclosure. EPSS data was not provided, the CVE is not listed in CISA KEV, and no public exploit identified at time of analysis, so this is not currently a mass-exploitation priority. However, the leaked credential is an LDAP bind account that frequently has broad directory-read (and sometimes write) privileges, so a successful read of the logs cascades into directory-wide credential exposure - a real concern for environments running Netatalk against corporate LDAP/AD. Prioritize patching where Netatalk is integrated with shared identity stores; deprioritize where Netatalk is standalone or uses local UAMs only.

An attacker who gains read access to a Netatalk server's log files - through a low-privileged local shell account, a misconfigured log-aggregation index, a stolen backup, or access to a centralized syslog collector - greps the logs for the LDAP simple-bind entries and recovers the cleartext directory bind password. They then reuse that credential to enumerate the corporate LDAP/Active Directory tree, harvest user attributes, and pivot toward further account compromise. No public exploit code is required; the 'exploit' is a log-search command.