Snipe-IT EUVD-2026-109458

Exploitation requires that Snipe-IT LDAP authentication is enabled and configured with TLS (ldap_enabled=1 and ldap_tls=1) - a non-default, operator-dependent configuration. The attacker must also hold an on-path network position between the Snipe-IT instance and the LDAP server (shared L2 segment, compromised intermediate hop, or a foothold in the same VPC/subnet) and must be able to answer the StartTLS extended request with a 'Protocol error' before the legitimate server responds (or the server must simply not negotiate StartTLS). No authentication to Snipe-IT itself is required (PR:N), and no user interaction is needed (UI:N); the limiting factors are the mandatory on-path position (CVSS AT:P) and the requirement that TLS-protected LDAP auth actually be configured. Deployments where the Snipe-IT-to-LDAP path is fully trusted/segmented, or where LDAP is not used, are not exposed.

This is a genuine but conditional credential-exposure flaw, not an internet-wide emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) carries AT:P, meaning a specific attack requirement must hold: the attacker must occupy an on-path position between Snipe-IT and the LDAP server. PR:N confirms no authentication is needed to the Snipe-IT application itself, and the vendor-confirmed impact is high confidentiality (VC:H) with no integrity or availability impact (VI:N/VA:N) - consistent with cleartext credential capture (CWE-319). No EPSS score was provided in the input, and the CVE is not listed in CISA KEV, so there is no public-exploitation signal; status is no public exploit identified at time of analysis. The vuln.today decision label is this_week, indicating prompt but not emergency prioritization. The key tension is that the raw 8.2 score (driven by network vector and high confidentiality) overstates opportunistic risk, because AT:P plus the required ldap_enabled/ldap_tls configuration means exploitation is realistically limited to attackers who already hold a network foothold on the path to the directory server. Where that position is attainable (shared L2 segment, same VPC/subnet, compromised intermediate hop), the payoff is severe: both the LDAP service-account credentials and every end-user login password are harvested in cleartext. Treat as high priority specifically for organizations running LDAP-authenticated Snipe-IT with TLS configured; lower practical urgency where the Snipe-IT-to-LDAP path is fully trusted and segmented.

An attacker with a foothold on the network path between Snipe-IT and its LDAP server (for example a compromised host on the same subnet or VPC) answers the StartTLS extended request with a Protocol error before the real directory server replies. Snipe-IT ignores the failed ldap_start_tls() return value and proceeds to bind in cleartext, so the attacker captures the LDAP service-account credentials on every search bind and each end-user password at interactive login while the login flow appears completely normal. No public exploit code was identified in the input, though the mechanism is fully documented in the vendor advisory.