CWE-90
AllowedImproper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
135 vulnerabilities reference this CWE, most recent first.
GHSA-8P37-98J5-XM75
Vulnerability from github – Published: 2022-05-17 03:03 – Updated: 2022-05-17 03:03EMC Isilon OneFS 8.0.0.0, EMC Isilon OneFS 7.2.1.0 - 7.2.1.2, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, and EMC Isilon OneFS 7.1.0.x is affected by an LDAP injection vulnerability that could potentially be exploited by a malicious user to compromise the system.
{
"affected": [],
"aliases": [
"CVE-2016-9870"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-01-23T07:59:00Z",
"severity": "HIGH"
},
"details": "EMC Isilon OneFS 8.0.0.0, EMC Isilon OneFS 7.2.1.0 - 7.2.1.2, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, and EMC Isilon OneFS 7.1.0.x is affected by an LDAP injection vulnerability that could potentially be exploited by a malicious user to compromise the system.",
"id": "GHSA-8p37-98j5-xm75",
"modified": "2022-05-17T03:03:05Z",
"published": "2022-05-17T03:03:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9870"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/540020/30/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95626"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9PFQ-C8XC-7Q54
Vulnerability from github – Published: 2026-05-19 12:31 – Updated: 2026-05-19 21:32Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.06.
Users are recommended to upgrade to version 24.09.06, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2026-41919"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-19T10:16:24Z",
"severity": "CRITICAL"
},
"details": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027) vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: before 24.09.06.\n\nUsers are recommended to upgrade to version 24.09.06, which fixes the issue.",
"id": "GHSA-9pfq-c8xc-7q54",
"modified": "2026-05-19T21:32:03Z",
"published": "2026-05-19T12:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41919"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/592czh9o69n74c036vy30fnqknocw74p"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/19/27"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C3FC-8QFF-9HWX
Vulnerability from github – Published: 2026-04-17 18:31 – Updated: 2026-04-18 01:06Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.
This issue affects BC-JAVA: from 1.74 before 1.84.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk14"
},
"ranges": [
{
"events": [
{
"introduced": "1.74"
},
{
"fixed": "1.84"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk15to18"
},
"ranges": [
{
"events": [
{
"introduced": "1.74"
},
{
"fixed": "1.84"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.bouncycastle:bcprov-jdk18on"
},
"ranges": [
{
"events": [
{
"introduced": "1.74"
},
{
"fixed": "1.84"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-0636"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-18T01:06:02Z",
"nvd_published_at": "2026-04-15T10:16:38Z",
"severity": "MODERATE"
},
"details": "Improper neutralization of special elements used in an LDAP query (\u0027LDAP injection\u0027) vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreHelper.\n\nThis issue affects BC-JAVA: from 1.74 before 1.84.",
"id": "GHSA-c3fc-8qff-9hwx",
"modified": "2026-04-18T01:06:02Z",
"published": "2026-04-17T18:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"type": "WEB",
"url": "https://github.com/bcgit/bc-java/commit/d20cdb8430e09224114fec0179a71859929fcbde"
},
{
"type": "PACKAGE",
"url": "https://github.com/bcgit/bc-java"
},
{
"type": "WEB",
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%900636"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/RE:M/U:Amber",
"type": "CVSS_V4"
}
],
"summary": "Bouncy Castle has an LDAP injection"
}
GHSA-C745-X889-V4RC
Vulnerability from github – Published: 2022-05-17 00:47 – Updated: 2025-04-20 03:45In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.
{
"affected": [],
"aliases": [
"CVE-2017-14596"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-20T18:29:00Z",
"severity": "CRITICAL"
},
"details": "In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.",
"id": "GHSA-c745-x889-v4rc",
"modified": "2025-04-20T03:45:35Z",
"published": "2022-05-17T00:47:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14596"
},
{
"type": "WEB",
"url": "https://blog.ripstech.com/2017/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596"
},
{
"type": "WEB",
"url": "https://developer.joomla.org/security-centre/711-20170902-core-ldap-information-disclosure"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100898"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039407"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CHJ8-5XGW-WCVJ
Vulnerability from github – Published: 2019-01-07 19:14 – Updated: 2021-09-09 18:04Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.karaf:apache-karaf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-8750"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:31:46Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.",
"id": "GHSA-chj8-5xgw-wcvj",
"modified": "2021-09-09T18:04:45Z",
"published": "2019-01-07T19:14:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8750"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1322"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-chj8-5xgw-wcvj"
},
{
"type": "WEB",
"url": "https://karaf.apache.org/security/cve-2016-8750.txt"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103098"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Moderate severity vulnerability that affects org.apache.karaf:apache-karaf"
}
GHSA-CMM2-4Q45-JPGH
Vulnerability from github – Published: 2022-05-13 01:02 – Updated: 2024-05-23 18:30MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN.
{
"affected": [],
"aliases": [
"CVE-2018-5730"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-06T20:29:00Z",
"severity": "MODERATE"
},
"details": "MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a \"linkdn\" and \"containerdn\" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN.",
"id": "GHSA-cmm2-4q45-jpgh",
"modified": "2024-05-23T18:30:52Z",
"published": "2022-05-13T01:02:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5730"
},
{
"type": "WEB",
"url": "https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2019:0327"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3071"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1551082"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1042071"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CQH3-JG8P-336J
Vulnerability from github – Published: 2026-05-26 23:39 – Updated: 2026-06-11 14:05Summary
An LDAP injection vulnerability exists in org.yamcs.security.LdapAuthModule when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping.
Root Cause
File: yamcs-core/src/main/java/org/yamcs/security/LdapAuthModule.java:233
The username parameter is inserted directly into an LDAP search filter without RFC 4515 escaping:
// VULNERABLE
var filter = userFilter.replace("{0}", username);
var searchResult = getSingleResult(ctx, userBase, filter, controls);
LDAP wildcard characters (*, (, )) are accepted without sanitization.
Impact
With a known valid password, username=* authenticates as the first user returned by the LDAP search — enabling horizontal privilege escalation between accounts sharing similar passwords or when the attacker knows one valid password.
This affects deployments that use org.yamcs.security.LdapAuthModule in their etc/security.yaml configuration file.
Proof of Concept
curl -X POST "http://TARGET:8090/auth/token" \
-d "grant_type=password&username=*&password=known_password"
# Returns token for first matching LDAP user
Fix
Apply RFC 4515 escaping before filter construction:
private static String escapeLdapFilter(String input) {
return input
.replace("\\", "\\5c")
.replace("*", "\\2a")
.replace("(", "\\28")
.replace(")", "\\29")
.replace("\0", "\\00");
}
var filter = userFilter.replace("{0}", escapeLdapFilter(username));
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.yamcs:yamcs-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42568"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-26T23:39:55Z",
"nvd_published_at": "2026-06-10T23:16:46Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nAn LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping.\n\n### Root Cause\n\n**File:** `yamcs-core/src/main/java/org/yamcs/security/LdapAuthModule.java:233`\n\nThe `username` parameter is inserted directly into an LDAP search filter without RFC 4515 escaping:\n\n```java\n// VULNERABLE\nvar filter = userFilter.replace(\"{0}\", username);\nvar searchResult = getSingleResult(ctx, userBase, filter, controls);\n```\n\nLDAP wildcard characters (`*`, `(`, `)`) are accepted without sanitization.\n\n### Impact\n\nWith a known valid password, `username=*` authenticates as the first user returned by the LDAP search \u2014 enabling horizontal privilege escalation between accounts sharing similar passwords or when the attacker knows one valid password.\n\nThis affects deployments that use `org.yamcs.security.LdapAuthModule` in their `etc/security.yaml` configuration file.\n\n### Proof of Concept\n\n```bash\ncurl -X POST \"http://TARGET:8090/auth/token\" \\\n -d \"grant_type=password\u0026username=*\u0026password=known_password\"\n# Returns token for first matching LDAP user\n```\n\n### Fix\n\nApply RFC 4515 escaping before filter construction:\n\n```java\nprivate static String escapeLdapFilter(String input) {\n return input\n .replace(\"\\\\\", \"\\\\5c\")\n .replace(\"*\", \"\\\\2a\")\n .replace(\"(\", \"\\\\28\")\n .replace(\")\", \"\\\\29\")\n .replace(\"\\0\", \"\\\\00\");\n}\nvar filter = userFilter.replace(\"{0}\", escapeLdapFilter(username));\n```",
"id": "GHSA-cqh3-jg8p-336j",
"modified": "2026-06-11T14:05:22Z",
"published": "2026-05-26T23:39:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cqh3-jg8p-336j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42568"
},
{
"type": "PACKAGE",
"url": "https://github.com/yamcs/yamcs"
},
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
},
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Yamcs Vulnerable to LDAP Injection in LdapAuthModule"
}
GHSA-CVF4-F829-762V
Vulnerability from github – Published: 2025-11-13 15:30 – Updated: 2025-11-13 23:10pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.9"
},
"package": {
"ecosystem": "PyPI",
"name": "pgadmin4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-12764"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-13T23:10:38Z",
"nvd_published_at": "2025-11-13T13:15:44Z",
"severity": "HIGH"
},
"details": "pgAdmin \u003c= 9.9\u00a0is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.",
"id": "GHSA-cvf4-f829-762v",
"modified": "2025-11-13T23:10:39Z",
"published": "2025-11-13T15:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12764"
},
{
"type": "WEB",
"url": "https://github.com/pgadmin-org/pgadmin4/issues/9325"
},
{
"type": "WEB",
"url": "https://github.com/pgadmin-org/pgadmin4/commit/09d2b7eeb0e330df73b1aef0cba57788fde52b6b"
},
{
"type": "PACKAGE",
"url": "https://github.com/pgadmin-org/pgadmin4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "pgAdmin is affected by an LDAP injection vulnerability"
}
GHSA-F786-73F3-CVMC
Vulnerability from github – Published: 2023-12-18 00:30 – Updated: 2023-12-18 00:30A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5. This issue affects some unknown processing of the file user,adap.jsp?actionFlag=test&id=1 of the component Bind Request Handler. The manipulation leads to ldap injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-248267. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2023-6905"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-18T00:15:11Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5. This issue affects some unknown processing of the file user,adap.jsp?actionFlag=test\u0026id=1 of the component Bind Request Handler. The manipulation leads to ldap injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-248267. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-f786-73f3-cvmc",
"modified": "2023-12-18T00:30:23Z",
"published": "2023-12-18T00:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6905"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.248267"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.248267"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FCQV-6JGJ-4XXC
Vulnerability from github – Published: 2026-07-30 18:31 – Updated: 2026-07-30 18:31A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.
{
"affected": [],
"aliases": [
"CVE-2026-58222"
],
"database_specific": {
"cwe_ids": [
"CWE-90"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T16:17:14Z",
"severity": "HIGH"
},
"details": "A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the \"msKds-RootKeyData\" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present.",
"id": "GHSA-fcqv-6jgj-4xxc",
"modified": "2026-07-30T18:31:39Z",
"published": "2026-07-30T18:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58222"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-58222"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502722"
},
{
"type": "WEB",
"url": "https://bugzilla.samba.org/show_bug.cgi?id=16148"
},
{
"type": "WEB",
"url": "https://www.samba.org/samba/security/CVE-2026-58222.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
CAPEC-136: LDAP Injection
An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value.