Which versions of Apache Shiro are affected by CVE-2026-49268?

Apache Shiro's LDAP authentication component (DefaultLdapRealm) contains an injection vulnerability allowing remote unauthenticated attackers to bypass authentication or impersonate users.. A patch is available.

How to fix or mitigate CVE-2026-49268?

Within 24 hours: Inventory all deployments of Apache Shiro versions ≤2.2.0 and 3.0.0-alpha-1 using DefaultLdapRealm. Within 7 days: implement compensating controls (see below) and enable LDAP operation monitoring. Within 30 days: maintain watch on Apache Shiro security advisories for patch release and prepare upgrade plan.

Apache Shiro CVE-2026-49268

Q: What is the CVSS score of CVE-2026-49268?

CVE-2026-49268 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:Red. EPSS exploitation probability: 0.5%.

HIGH

LDAP Injection (CWE-90)

2026-06-17 apache

GHSA-x96m-rh44-vgv8

LDAP Apache Code Injection Authentication Bypass Apache Shiro

8.8

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:Red

vuln.today AI

8.2 HIGH

Network-reachable login with no auth or UI (AV:N/AC:L/PR:N/UI:N); integrity high due to authentication bypass/impersonation, confidentiality low from incidental data exposure, availability unaffected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:29 vuln.today

CVE Published

Jun 17, 2026 - 13:07 cve.org

HIGH 8.8

DescriptionCVE.org

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.

This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.

AnalysisAI

LDAP injection in Apache Shiro's DefaultLdapRealm allows remote unauthenticated attackers to manipulate Distinguished Name construction during LDAP bind authentication, potentially bypassing authentication or impersonating other users. The flaw affects all versions through 2.2.0 and 3.0.0-alpha-1 when DefaultLdapRealm is in use, with no public exploit identified at time of analysis. The CVSS 4.0 score of 8.8 reflects high integrity impact against an authentication-critical component.

Technical ContextAI

Apache Shiro is a widely deployed Java security framework providing authentication, authorization, cryptography, and session management. The DefaultLdapRealm class performs user authentication by binding to an LDAP directory with a Distinguished Name (DN) constructed from a template (e.g., 'uid={0},ou=users,dc=example,dc=com') into which the user-supplied username is interpolated. Because the username is concatenated directly without escaping RFC 2253 special characters (such as commas, equals signs, plus signs, backslashes, quotes, and angle brackets), an attacker can alter the resulting DN structure. This is a classic CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query) issue, where injection occurs in DN construction rather than in an LDAP search filter, enabling identity manipulation at the bind step itself.

RemediationAI

Vendor-released patch: upgrade to Apache Shiro 2.2.1 (for the 2.x line) or 3.0.0-alpha-2 or later (for the 3.x pre-release line), per the Apache advisory at https://lists.apache.org/thread/svszql3od8td7hn6conyj2oq70v53b5s. If an immediate upgrade is not feasible, compensating controls include switching authentication to a non-affected realm such as ActiveDirectoryRealm or JdbcRealm (which avoids DN concatenation entirely but requires reconfiguring user/group lookup), or placing a reverse proxy / WAF rule in front of the login endpoint that rejects usernames containing RFC 2253 metacharacters (,, =, +, \, ", <, >, ;, leading/trailing spaces, leading #) - note this can break legitimate logins for users whose directory DNs legitimately contain such characters. As a last resort, restrict network access to the LDAP-authenticated application to trusted networks or VPN clients to reduce attack surface while patching is scheduled.