Loading story…
Apache Zeppelin disclosed CVE-2026-44617, a moderate-severity LDAP filter injection flaw in its LdapRealm component caused by using RFC 4514 distinguished-name escaping where RFC 4515 LDAP search-filter escaping was required. The bug left LDAP filter metacharacters such as parentheses and asterisks insufficiently escaped, making the issue an incomplete fix for CVE-2024-31867. Apache said the vulnerability affects Zeppelin versions 0.11.1, 0.11.2, and 0.12.0, and advised users to upgrade to 0.12.1.
The underlying code changes separate RFC 4515 filter escaping from RFC 4514 DN escaping across LDAP realm handling, including filter and DN substitution paths in LdapRealm and ActiveDirectoryGroupRealm. The fix adds a dedicated RFC 4515 filter-escaping utility, routes template substitutions through safer helpers, preserves a special full-DN passthrough case for a bare {0} DN template, and expands coverage with unit, fuzz, and injection-focused tests before the patch was merged into the Apache Zeppelin codebase.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Apache Zeppelin disclosed CVE-2026-44617, a moderate-severity LDAP filter injection flaw in LdapRealm described as an incomplete fix for CVE-2024-31867. The advisory says versions 0.11.1, 0.11.2, and 0.12.0 are affected and advises users to upgrade to 0.12.1.
Apache Zeppelin merged pull request #5226 to correct improper LDAP escaping in LdapRealm and ActiveDirectoryGroupRealm by separating RFC 4515 filter escaping from RFC 4514 distinguished-name escaping and adding related tests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-49268**, a high-severity LDAP Distinguished Name injection flaw in Apache Shiro’s `DefaultLdapRealm` that can let remote attackers manipulate LDAP bind authentication. The vulnerability is caused by directly concatenating user-supplied usernames into an LDAP DN template without escaping RFC 2253 special characters, allowing an attacker to alter DN construction and potentially bypass authentication or impersonate legitimate users. The issue carries a **CVSS v4 score of 8.8** and is considered remotely exploitable. The flaw affects Apache Shiro `shiro-core` through **2.2.0** and **3.0.0-alpha-0** through **3.0.0-alpha-1** when `DefaultLdapRealm` is in use. Apache said organizations should identify deployments using that realm and upgrade to **2.2.1** or **3.0.0-alpha-2** or later; input escaping for usernames is also recommended. The advisory credited **zhaokaifei of ChinaTelecom** with reporting the issue and **Lenny Primak** with developing the fix.
Jun 29, 2026
The Apache Software Foundation released security updates for **Apache CXF** to fix three newly disclosed vulnerabilities affecting enterprise deployments of the services framework. The flaws include **`CVE-2026-44930`**, an LDAP injection issue in the XKMS LDAP certificate repository that can let attackers manipulate backend search filters and retrieve arbitrary digital certificates, potentially enabling impersonation, interception of encrypted communications, and lateral movement. Apache also addressed an **XXE** flaw in WS-Transfer caused by insecure XML parser configuration, which could expose sensitive files and support internal network mapping, as well as a possible **remote code execution** condition tied to an incomplete fix for an older JMS-related bug. Affected releases include **4.2.0**, **4.0.0 through 4.1.5**, and older branches before **3.6.11**. Apache published patched versions **4.2.1**, **4.1.6**, and **3.6.11**, and guidance urges organizations to upgrade immediately, review LDAP access controls, monitor certificate access activity, and reduce exposure of XKMS components where possible. The disclosures indicate that while the LDAP flaw does not itself provide code execution, the combined set of weaknesses could materially affect trust infrastructure and server security in vulnerable environments.
Jun 29, 2026
Apache disclosed **CVE-2026-48827**, a path traversal flaw in the `org.apache.sshd:sshd-git` bundle of Apache MINA SSHD that lets an SSH-authenticated user escape the configured Git root by supplying repository paths containing traversal sequences such as `../`. The issue affects `sshd-git` versions `2.0.0` through `2.17.1` and `3.0.0-M1` through `3.0.0-M3`, impacting `git-upload-pack`, `git-receive-pack`, and related operations. Successful exploitation can expose arbitrary Git repositories on the server filesystem and, in some cases, allow unauthorized writes outside the intended root. Apache fixed the bug in versions `2.18.0` and `3.0.0-M4` by adding centralized path validation, and noted that deployments using Apache MINA SSHD without the non-default `sshd-git` module are not affected. Apache also disclosed **CVE-2026-35563** in the Apache Directory LDAP API client, where versions `2.0.0` through `2.1.7` failed to verify whether a TLS server certificate matched the intended LDAP hostname. Because the client would accept a trusted certificate issued for an unrelated host, an attacker with man-in-the-middle network access could impersonate the LDAP server and fully compromise the connection. The flaw is tracked as `CWE-297`, and Apache said hostname verification is now enforced in a newer LDAP API release. The disclosures highlight two separate Apache security fixes affecting repository isolation in SSH-based Git services and certificate validation in LDAP client connections.
Jun 29, 2026