EUVD-2026-31433
GHSA-pg32-686q-qh6x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed CXF XKMS endpoint
-
DeliveryCraft certificate request with LDAP metacharacters
-
ExploitInjected filter broadens LDAP search
-
ExecutionRepository returns unauthorized certificates
-
ImpactHarvest arbitrary certificates
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization LDAP query parameterization
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target run the Apache CXF XKMS server with its certificate repository configured to use the LDAP backend - this specific feature is the precondition named in the description, so default CXF deployments that do not enable the XKMS LDAP certificate repository are not exposed. Where that component is enabled, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, low-complexity, unauthenticated requests with no user interaction. Limiting factors: the non-default XKMS+LDAP configuration sharply narrows the affected population, the impact is confined to reading certificates from the repository (no described write or service-disruption capability), and network reachability of the XKMS endpoint governs whether external or only internal attackers can trigger it. |
| Impact | Signals conflict and should be reconciled before treating this as a top-tier emergency. The supplied CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical), but the description only supports unauthorized retrieval (read) of certificates - a confidentiality impact - with no described integrity or availability effect, so the I:H/A:H components appear overstated and realistic severity is closer to a high-confidentiality-only issue (~7.5). Lower-level signals corroborate a more measured priority: EPSS is 0.02% (4th percentile), CISA SSVC rates Exploitation 'none', Automatable 'no', and Technical Impact only 'partial', there is no KEV listing, and no public exploit identified at time of analysis. The key mitigating factor is exposure: only deployments that actually run the XKMS server with an LDAP-backed certificate repository are affected, a niche configuration despite CXF's broad install base. Net: patch on a normal cycle rather than as a fire drill, but prioritize any internet-reachable XKMS endpoints. |
| Exploit ScenarioDerived | An attacker who can reach an exposed Apache CXF XKMS server submits a certificate-lookup request containing LDAP filter metacharacters (such as '*') in a field that is concatenated into the directory search filter. The malformed filter widens the LDAP query so the repository returns certificates the attacker was never meant to access, enabling harvesting of arbitrary certificates from the store. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N the request needs only network reach and no authentication, though no public PoC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 30, 2026
Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90) in the LDAP-backed certificate repository to retrieve certificates they are not authorized to see. Affected builds span Apache CXF 3.x before 3.6.11, 4.0.0-4.1.x before 4.1.6, and 4.2.0 before 4.2.1; the issue was reported by Apache itself and fixed in those releases. No public exploit identified at time of analysis, EPSS is very low (0.02%, 4th percentile), and CISA SSVC scores exploitation as 'none' with only 'partial' technical impact.
RemediationAI
Vendor-released patch: upgrade Apache CXF to 4.2.1, 4.1.6, or 3.6.11 depending on your branch, as directed in the Apache advisory (https://lists.apache.org/thread/c1zqxppo1m5z3kbdhjn5p991zk09ynkh); this is the primary and recommended fix. If you cannot upgrade immediately, the most effective compensating control is to disable or decommission the XKMS server component if it is not in use, which fully removes the attack surface at the cost of XKMS key-management functionality. Where XKMS must remain enabled, restrict network access to the XKMS endpoint to trusted internal callers via network ACLs or reverse-proxy allowlisting, accepting that legitimate remote clients must be enumerated; and if feasible, harden the backing LDAP service so the bind account used by the certificate repository has least-privilege read scope, limiting how much an injected filter can return. Red Hat customers should consult the VEX at https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44930.json for product-specific fixed packages.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache CXF is a widely used open-source Java services framework for building SOAP/REST web services. The flaw lives in its optional XKMS (XML Key Management Specification) server component, specifically the certificate repository implementation backed by an LDAP directory. When the XKMS server builds an LDAP search filter from attacker-influenced input without proper escaping, it is vulnerable to CWE-90 (LDAP Injection): crafted metacharacters (e.g. '*', parentheses, filter operators) alter the intended search filter so the directory returns certificate entries beyond those the request should match. The single CPE in scope is cpe:2.3:a:apache_software_foundation:apache_cxf, confirming the affected component is the CXF framework itself, though Red Hat references indicate the code is also tracked in Red Hat products that embed CXF.
Know when LDAP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated LDAP injection (AV:N/AC:L/PR:N) yields unauthorized certificate disclosure only, so C:H with I:N/A:N since no write or availability impact is described.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Blast Radius
ecosystem impact- 1 maven packages depend on org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.2.0.
Executive ViewAI
Apache CXF's XKMS server contains an LDAP injection vulnerability (CVE-2026-44930) that allows remote attackers to retrieve X.509 certificates beyond their authorization scope. Organizations deploying CXF with LDAP-backed certificate repositories face risk to certificate-based identity and access controls; the CRITICAL CVSS score (9.8) reflects high technical impact, though real-world exploitation likelihood remains minimal (EPSS 0.02%, CISA SSVC 'none') with no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,
An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi
An authenticated GitLab user can seize control of an existing LDAP-backed account on instances that have both OmniAuth S
LDAP injection in Central Dogma's Apache Shiro-based authentication module exposes unauthenticated remote attackers to a
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut
Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at
A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6
Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p
An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i
An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the P
Exploit-DB