CVE-2026-49268
Last modified
CVE-2026-49268 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. EPSS estimates a 0.49% chance of exploitation in the next 30 days.
Description
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users. This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:Red
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Apache | Shiro | < 2.2.1 | — |
| Apache | Shiro | 3.0.0 | Alpha1 |
References
- https://lists.apache.org/thread/svszql3od8td7hn6conyj2oq70v53b5sMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/06/17/8Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-49268?
How severe is CVE-2026-49268?
How do I fix CVE-2026-49268?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-49258Nebula Mesh is a self-hosted control plane for the Slack Neb…8.8
- CVE-2026-4926Impact: A bad regular expression is generated any time you …7.5
- CVE-2026-49260PhpWeasyPrint is a PHP library allowing PDF generation from …8.2
- CVE-2026-49261MariaDB server is a community developed fork of MySQL server…9.8
- CVE-2026-49262In the Aimeos Pagible content management system prior to ver…3
- CVE-2026-49267Apache Airflow's EmailOperator and the underlying `airflow.u…5.9
- CVE-2026-49269Apple M1 GPUs retain register file data between compute shad…8.6
- CVE-2026-4927Exposure of sensitive information in the users MFA feature i…6.5
- CVE-2026-49270Exposure of Sensitive Information Through Metadata vulnerabi…5.9
- CVE-2026-49271libheif is a HEIF and AVIF file format decoder and encoder. …6.5
- CVE-2026-49274Kirby is an open-source content management system. Prior to …5.3
- CVE-2026-49276Kirby is an open-source content management system. Prior to …7.4
Are you affected by CVE-2026-49268?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST