Loading story…
Apache disclosed CVE-2026-49268, a high-severity LDAP Distinguished Name injection flaw in Apache Shiro’s DefaultLdapRealm that can let remote attackers manipulate LDAP bind authentication. The vulnerability is caused by directly concatenating user-supplied usernames into an LDAP DN template without escaping RFC 2253 special characters, allowing an attacker to alter DN construction and potentially bypass authentication or impersonate legitimate users. The issue carries a CVSS v4 score of 8.8 and is considered remotely exploitable.
The flaw affects Apache Shiro shiro-core through 2.2.0 and 3.0.0-alpha-0 through 3.0.0-alpha-1 when DefaultLdapRealm is in use. Apache said organizations should identify deployments using that realm and upgrade to 2.2.1 or 3.0.0-alpha-2 or later; input escaping for usernames is also recommended. The advisory credited zhaokaifei of ChinaTelecom with reporting the issue and Lenny Primak with developing the fix.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Apache identified affected versions as Shiro through 2.2.0 and 3.0.0-alpha-0 through 3.0.0-alpha-1 when DefaultLdapRealm is used, and published remediation guidance. Users are advised to upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later to address the vulnerability.
Apache disclosed CVE-2026-49268, a high-severity LDAP Distinguished Name injection flaw in Apache Shiro's DefaultLdapRealm caused by concatenating unescaped usernames into an LDAP DN template. The issue can allow remote attackers to manipulate LDAP bind authentication, potentially bypassing authentication or impersonating users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-56091**, an authentication bypass vulnerability in the Apache Shiro `shiro-guice` module when deployed in a web servlet context. The flaw allows a specially crafted HTTP request to bypass authentication checks, creating a risk that unauthenticated users could reach protected application functionality. Apache described the issue as similar to **CVE-2020-1957**, but affecting `shiro-guice` rather than `shiro-spring`. The vulnerability affects all Apache Shiro **2.x** releases and `3.0.0-alpha-0` through `3.0.0-alpha-1` for the `org.apache.shiro:shiro-guice` component under the specified deployment conditions. Apache said the issue is remediated in **Apache Shiro 3.0.0 and later** and advised users to upgrade. The vulnerability was credited to **LocalHost** for discovery, with **Lenny Primak** credited for developing the fix.
Jun 29, 2026
Apache Zeppelin disclosed **CVE-2026-44617**, a moderate-severity LDAP filter injection flaw in its `LdapRealm` component caused by using RFC 4514 distinguished-name escaping where RFC 4515 LDAP search-filter escaping was required. The bug left LDAP filter metacharacters such as parentheses and asterisks insufficiently escaped, making the issue an incomplete fix for **CVE-2024-31867**. Apache said the vulnerability affects Zeppelin versions **0.11.1**, **0.11.2**, and **0.12.0**, and advised users to upgrade to **0.12.1**. The underlying code changes separate RFC 4515 filter escaping from RFC 4514 DN escaping across LDAP realm handling, including filter and DN substitution paths in `LdapRealm` and `ActiveDirectoryGroupRealm`. The fix adds a dedicated RFC 4515 filter-escaping utility, routes template substitutions through safer helpers, preserves a special full-DN passthrough case for a bare `{0}` DN template, and expands coverage with unit, fuzz, and injection-focused tests before the patch was merged into the Apache Zeppelin codebase.
Jul 30, 2026
**Apache Druid** fixed an **authentication bypass** in its `druid-basic-security` extension when Druid is configured to authenticate against **LDAP** and the backing LDAP server permits **anonymous binds**. Under this configuration, an attacker can supply a valid username with an **empty password** and be incorrectly treated as authenticated because Druid misinterprets an “anonymous bind success” response as proof of successful user authentication (**CVE-2026-23906**). The issue is rated “Important” severity by the Apache Software Foundation and enables remote, unauthenticated access to Druid clusters. Successful exploitation allows an attacker to inherit the permissions of the impersonated account, potentially enabling access to sensitive data in Druid datasources, execution of queries, data manipulation, and access to administrative interfaces if a privileged user is targeted. Affected versions are reported as **0.17.0 through 35.x (all versions prior to 36.0.0)** when the LDAP authenticator is in use; immediate mitigation is to **disable LDAP anonymous bind** on the directory server, and organizations should apply the vendor’s security update/upgrade to a fixed release.
Jun 29, 2026