Monthly
LDAP injection (CWE-90) in Progress MOVEit Transfer lets an authenticated low-privilege user manipulate the LDAP query constructed by the optional LDAP authentication/directory module, potentially altering directory lookups, bypassing intended filter logic, or reading and modifying data the account should not reach. Only instances that have the LDAP module enabled and configured are exposed, and only versions before 2025.1.6 or in the 2026.0.0 through 2026.0.3 range are affected; because the flaw requires a valid account (PR:L) and unusual, non-trivial conditions in how input reaches the LDAP query (AC:H), it is not a pre-authentication or trivially repeatable attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor advisory is the authoritative source for fixed builds.
Authentication bypass in LibreNMS before 26.9.0 allows unauthenticated remote attackers to gain administrative access when the system is configured for LDAP or Active Directory authorization and the REMOTE_USER server variable is not forwarded by an upstream proxy. The flaw arises because usernames are inserted unescaped into LDAP search filters, and authentication only verifies that a matching entry exists; an attacker can supply a wildcard username via the HTTP Basic Authorization header (PHP_AUTH_USER) to match all users and groups, resulting in admin privileges. Exploitation requires the vulnerable authorization mode to be active and REMOTE_USER to be absent; installations using other auth backends or a correctly configured front-end proxy are not exploitable via this path. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Authentication bypass in the optional sshd-ldap component of Apache MINA SSHD (versions 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) lets unauthenticated remote attackers complete SSH authentication by submitting the literal username "*" with the password "*", because LDAP filter metacharacters from user-supplied credentials are not escaped before being embedded in the search filter. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw is trivially reachable but only on servers that both embed the MINA SSHD library and have deployed and configured sshd-ldap for password or publickey authentication; stock MINA SSHD deployments without that optional component are entirely unaffected, and no public exploit code was identified at time of analysis. Apache ships fixes in 2.20.0 and 3.0.0-M6, which apply proper RFC 4515 escaping.
LDAP filter injection in Apache Karaf before 4.4.12 allows a crafted login name to alter the structure of LDAP search filters built by LDAPCache and LDAPBackingEngine, potentially matching an unintended directory entry, over-granting roles, or changing which account a login resolves to. The unescaped value only reaches the filter through two call paths - the GSSAPILdapLoginModule (Kerberos/SPNEGO), which passes the NameCallback name through unescaped, and the LDAPBackingEngine.listRoles path, which passes principal.getName() unescaped - because the default LDAPLoginModule and LDAPPubkeyLoginModule both pre-escape the login name via Util.doRFC2254Encoding(). The issue is remote and unauthenticated per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, score 7.3), but real-world impact is bounded by the administrator-configured userFilter/roleFilter templates; there is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.25% (14th percentile). A vendor patch is available in Apache Karaf 4.4.12.
LDAP injection in Apache APISIX's ldap-auth plugin allows a caller holding valid credentials for any LDAP directory entry to authenticate to the gateway as a different consumer - including entries outside the subtree the plugin was configured to restrict access to. Affected versions span 2.11.0 through 3.17.0, covering several years of releases. No public exploit code or active exploitation has been identified at time of analysis, but the primitive (credential-bearing lateral identity escalation at the API gateway layer) is high-value in multi-tenant or zero-trust deployments.
LDAP Injection in Liderahenk, TÜBİTAK BİLGEM's centralized Linux management platform, enables unauthenticated remote attackers to manipulate LDAP queries and extract sensitive directory data - including user accounts, credentials, and organizational attributes - from the underlying directory service. Affected versions span 3.4.0 through 3.5.4. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low-complexity unauthenticated attack vector makes this accessible to a wide range of threat actors targeting Turkish public sector infrastructure.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.
Directory data disclosure in PEAKUP Technology's PassGate (all versions through build 30042026) allows remote unauthenticated attackers to manipulate LDAP queries by injecting special characters into user-controlled input. Reported by TR-CERT (Turkey's national CERT), the flaw carries a CVSS 8.2 driven by high confidentiality impact with no authentication or user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, indicating no confirmed active exploitation.
Privilege-escalation-capable LDAP injection in HAVELSAN Liman MYS (all releases before Master.1107) lets an authenticated attacker inject unsanitized special characters into LDAP queries, subverting directory-backed authentication and authorization logic. Because Liman is typically wired into corporate LDAP/Active Directory for login, a successful injection can expose directory data, bypass access controls, and manipulate query results. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list; risk is driven by the high CVSS 8.8 rating rather than confirmed in-the-wild activity.
LDAP injection (CWE-90) in Progress MOVEit Transfer lets an authenticated low-privilege user manipulate the LDAP query constructed by the optional LDAP authentication/directory module, potentially altering directory lookups, bypassing intended filter logic, or reading and modifying data the account should not reach. Only instances that have the LDAP module enabled and configured are exposed, and only versions before 2025.1.6 or in the 2026.0.0 through 2026.0.3 range are affected; because the flaw requires a valid account (PR:L) and unusual, non-trivial conditions in how input reaches the LDAP query (AC:H), it is not a pre-authentication or trivially repeatable attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor advisory is the authoritative source for fixed builds.
Authentication bypass in LibreNMS before 26.9.0 allows unauthenticated remote attackers to gain administrative access when the system is configured for LDAP or Active Directory authorization and the REMOTE_USER server variable is not forwarded by an upstream proxy. The flaw arises because usernames are inserted unescaped into LDAP search filters, and authentication only verifies that a matching entry exists; an attacker can supply a wildcard username via the HTTP Basic Authorization header (PHP_AUTH_USER) to match all users and groups, resulting in admin privileges. Exploitation requires the vulnerable authorization mode to be active and REMOTE_USER to be absent; installations using other auth backends or a correctly configured front-end proxy are not exploitable via this path. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Authentication bypass in the optional sshd-ldap component of Apache MINA SSHD (versions 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) lets unauthenticated remote attackers complete SSH authentication by submitting the literal username "*" with the password "*", because LDAP filter metacharacters from user-supplied credentials are not escaped before being embedded in the search filter. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw is trivially reachable but only on servers that both embed the MINA SSHD library and have deployed and configured sshd-ldap for password or publickey authentication; stock MINA SSHD deployments without that optional component are entirely unaffected, and no public exploit code was identified at time of analysis. Apache ships fixes in 2.20.0 and 3.0.0-M6, which apply proper RFC 4515 escaping.
LDAP filter injection in Apache Karaf before 4.4.12 allows a crafted login name to alter the structure of LDAP search filters built by LDAPCache and LDAPBackingEngine, potentially matching an unintended directory entry, over-granting roles, or changing which account a login resolves to. The unescaped value only reaches the filter through two call paths - the GSSAPILdapLoginModule (Kerberos/SPNEGO), which passes the NameCallback name through unescaped, and the LDAPBackingEngine.listRoles path, which passes principal.getName() unescaped - because the default LDAPLoginModule and LDAPPubkeyLoginModule both pre-escape the login name via Util.doRFC2254Encoding(). The issue is remote and unauthenticated per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, score 7.3), but real-world impact is bounded by the administrator-configured userFilter/roleFilter templates; there is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.25% (14th percentile). A vendor patch is available in Apache Karaf 4.4.12.
LDAP injection in Apache APISIX's ldap-auth plugin allows a caller holding valid credentials for any LDAP directory entry to authenticate to the gateway as a different consumer - including entries outside the subtree the plugin was configured to restrict access to. Affected versions span 2.11.0 through 3.17.0, covering several years of releases. No public exploit code or active exploitation has been identified at time of analysis, but the primitive (credential-bearing lateral identity escalation at the API gateway layer) is high-value in multi-tenant or zero-trust deployments.
LDAP Injection in Liderahenk, TÜBİTAK BİLGEM's centralized Linux management platform, enables unauthenticated remote attackers to manipulate LDAP queries and extract sensitive directory data - including user accounts, credentials, and organizational attributes - from the underlying directory service. Affected versions span 3.4.0 through 3.5.4. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low-complexity unauthenticated attack vector makes this accessible to a wide range of threat actors targeting Turkish public sector infrastructure.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.
Directory data disclosure in PEAKUP Technology's PassGate (all versions through build 30042026) allows remote unauthenticated attackers to manipulate LDAP queries by injecting special characters into user-controlled input. Reported by TR-CERT (Turkey's national CERT), the flaw carries a CVSS 8.2 driven by high confidentiality impact with no authentication or user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, indicating no confirmed active exploitation.
Privilege-escalation-capable LDAP injection in HAVELSAN Liman MYS (all releases before Master.1107) lets an authenticated attacker inject unsanitized special characters into LDAP queries, subverting directory-backed authentication and authorization logic. Because Liman is typically wired into corporate LDAP/Active Directory for login, a successful injection can expose directory data, bypass access controls, and manipulate query results. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list; risk is driven by the high CVSS 8.8 rating rather than confirmed in-the-wild activity.