Loading story…
Apache Druid fixed an authentication bypass in its druid-basic-security extension when Druid is configured to authenticate against LDAP and the backing LDAP server permits anonymous binds. Under this configuration, an attacker can supply a valid username with an empty password and be incorrectly treated as authenticated because Druid misinterprets an “anonymous bind success” response as proof of successful user authentication (CVE-2026-23906). The issue is rated “Important” severity by the Apache Software Foundation and enables remote, unauthenticated access to Druid clusters.
Successful exploitation allows an attacker to inherit the permissions of the impersonated account, potentially enabling access to sensitive data in Druid datasources, execution of queries, data manipulation, and access to administrative interfaces if a privileged user is targeted. Affected versions are reported as 0.17.0 through 35.x (all versions prior to 36.0.0) when the LDAP authenticator is in use; immediate mitigation is to disable LDAP anonymous bind on the directory server, and organizations should apply the vendor’s security update/upgrade to a fixed release.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
The Apache Software Foundation released Apache Druid 36.0.0 to fix CVE-2026-23906, an authentication bypass affecting deployments using druid-basic-security with LDAP authentication and LDAP servers that allow anonymous binds. The flaw affects Druid versions 0.17.0 through all 35.x releases, and administrators were advised to disable anonymous bind as a workaround if they could not upgrade immediately.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-49268**, a high-severity LDAP Distinguished Name injection flaw in Apache Shiro’s `DefaultLdapRealm` that can let remote attackers manipulate LDAP bind authentication. The vulnerability is caused by directly concatenating user-supplied usernames into an LDAP DN template without escaping RFC 2253 special characters, allowing an attacker to alter DN construction and potentially bypass authentication or impersonate legitimate users. The issue carries a **CVSS v4 score of 8.8** and is considered remotely exploitable. The flaw affects Apache Shiro `shiro-core` through **2.2.0** and **3.0.0-alpha-0** through **3.0.0-alpha-1** when `DefaultLdapRealm` is in use. Apache said organizations should identify deployments using that realm and upgrade to **2.2.1** or **3.0.0-alpha-2** or later; input escaping for usernames is also recommended. The advisory credited **zhaokaifei of ChinaTelecom** with reporting the issue and **Lenny Primak** with developing the fix.
Jun 29, 2026
Red Hat released fixes for **CVE-2026-18922**, a critical (CVSS 9.8) authentication-bypass vulnerability in 389 Directory Server. An unauthenticated attacker able to connect over LDAPS can submit a failed SASL PLAIN bind using `cn=Directory Manager`, then perform a SASL ANONYMOUS bind on the same connection; Cyrus SASL can retain the prior identity, granting Directory Manager privileges with full confidentiality, integrity, and availability impact. The updates also remediate **CVE-2026-18355**, a SASL wrapped-record heap buffer overflow; **CVE-2026-18453**, a pre-authentication NULL-pointer denial of service; and **CVE-2026-76560**, which lets anonymous LDAP clients bypass certain SELFDN ACI bind-rule checks using an empty bind DN. Red Hat issued advisories for affected 389 Directory Server and Red Hat Directory Server packages across supported RHEL 6, 8, 9, and 10 streams; administrators should promptly apply the relevant `389-ds-base` or `redhat-ds` updates. No known public exploits were reported in the referenced advisories.
Sep 14, 2026
Microsoft disclosed and patched **CVE-2017-8563**, an elevation-of-privilege flaw in Windows LDAP authentication that could let a man-in-the-middle attacker forward authentication requests to a vulnerable LDAP server. The issue affects Windows LDAP servers, including systems running **Active Directory Domain Services (AD DS)** and **Active Directory Lightweight Directory Services (AD LDS)**, when they are configured to require signing or sealing on incoming connections. The security update adds support for **Extended Protection for Authentication**, allowing affected LDAP servers to detect and block forwarded authentication attempts. Organizations using Windows-based directory services are advised to apply the Microsoft update and enable the protection to reduce the risk of authentication relay leading to privilege escalation in Active Directory environments.
Jun 29, 2026