CWE-90— LDAP Injection

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.— MITRE CWE catalog

80 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-90page 2 of 2

CVE-2026-27860MEDIUMCVSS 5.3EG 5.3
2026-03-27
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, …
CVE-2026-29131HIGHCVSS 7.5EG 7.5
2026-04-02
SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to read the contents of emails encrypted for other users.
CVE-2026-29138HIGHCVSS 7.5EG 7.5
2026-04-02
SEPPmail Secure Email Gateway before version 15.0.3 allows attackers with a specially crafted email address to claim another user's PGP signature as their own.
CVE-2026-31828HIGHCVSS 8.8EG 8.8
2026-03-10
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.13 and 8.6.26, the LDAP authentication adapter is vulnerable to LDAP injection. User-supplied input (authData.id) …
CVE-2026-33289CRITICALCVSS 9.8EG 9.8
2026-03-20
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP Injection vulnerability exists in the SuiteCRM authentication flow. The application fails…
CVE-2026-33609MEDIUMCVSS 5.3EG 5.3
2026-04-22
Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees.
CVE-2026-33751MEDIUMCVSS 4.8EG 4.8
2026-03-25
n8n is an open source workflow automation platform. Prior to versions 1.123.27, 2.13.3, and 2.14.1, a flaw in the LDAP node's filter escape logic allowed LDAP metacharacters to pass through unescaped when user-controlled input was interpol…
CVE-2026-34578HIGHCVSS 8.2EG 8.2
2026-04-09
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker c…
CVE-2026-39962CRITICALCVSS 9.6EG 9.6
2026-04-09
MISP is an open source threat intelligence and sharing platform. Prior to 2.5.36, improper neutralization of special elements in an LDAP query in ApacheAuthenticate.php allows LDAP injection via an unsanitized username value when ApacheAut…
CVE-2026-40193HIGHCVSS 8.2EG 8.2
2026-04-16
maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.Repla…
CVE-2026-40459HIGHCVSS 8.8EG 8.8
2026-04-17
PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operatio…
CVE-2026-40606MEDIUMCVSS 4.8EG 4.8
2026-04-21
mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does no…
CVE-2026-41919CRITICALCVSS 9.1EG 9.1
2026-05-19
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the i…
CVE-2026-4256HIGHCVSS 8.2EG 8.2
2026-07-09
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection. This issue affects PassGate: through 30042026.
CVE-2026-42568MEDIUMCVSS 4.3EG 4.3
2026-05-26
Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the…
CVE-2026-44063MEDIUMCVSS 4.2EG 4.2
2026-05-21
An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input.
CVE-2026-44304HIGHCVSS 8.1EG 8.1
2026-05-12
Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inj…
CVE-2026-44616MEDIUMCVSS 6.5EG 6.5
2026-07-30
LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endp…
CVE-2026-44617MEDIUMCVSS 6.5EG 6.5
2026-07-30
LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving special filter characters insufficiently escaped…
CVE-2026-44671HIGHCVSS 7.5EG 7.5
2026-05-14
ZITADEL is an open source identity management platform. From 2.71.11 to before 3.4.10 and 4.15.0, a vulnerability was discovered in Zitadel's LDAP identity provider implementation, which fails to properly escape user-provided usernames bef…
CVE-2026-44930CRITICALCVSS 9.8EG 9.8
2026-05-26
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 o…
CVE-2026-45559MEDIUMCVSS 4.9EG 4.9
2026-06-10
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, get_ldap_email (app/modules/roxywi/user.py:120-157) builds the LDAP search filter via f-string concatenation. The usernam…
CVE-2026-46745MEDIUMCVSS 5.3EG 5.3
2026-05-25
Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability (CWE-90) that allows unauthenticated attackers to exfiltrate directory data or bypass authentication. Upgrade to apache-airflow-providers-fab 3.6.4 or later. I…
CVE-2026-47303HIGHCVSS 8.8EG 8.8
2026-07-14
Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-49268CRITICALCVSS 9.1EG 9.1
2026-06-17
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 …
CVE-2026-57288LOWCVSS 3.7EG 3.7
2026-06-24
Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters…
CVE-2026-58222HIGHCVSS 8.8EG 8.8
2026-07-30
A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribut…
CVE-2026-59652MEDIUMCVSS 6.9EG 6.9
2026-08-03
In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.
CVE-2026-74241MEDIUMCVSS 6.5EG 6.5
2026-08-14
A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows …
CVE-2026-76373MEDIUMCVSS 5.4EG 5.4
2026-08-19
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups,…

Map vulnerabilities like CWE-90 to your infrastructure

EchelonGraph correlates every CVE — across CWE-90 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →