Loading story…
Apache disclosed CVE-2026-94053, a critical LDAP injection flaw in the optional sshd-ldap component of Apache MINA SSHD. SSH servers using this component for password or public-key authentication can allow unauthenticated remote login because LDAP filter metacharacters were not escaped; an attacker can authenticate with * as both the username and password. The vulnerability is rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is classified as CWE-90 and CWE-305.
Affected releases are Apache MINA SSHD 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5, but exposure is limited to deployments that have configured sshd-ldap authentication. Organizations should identify internet-reachable and internal SSH services using this integration and upgrade to 2.20.0 or 3.0.0-M6, which escape LDAP filter parameters in accordance with RFC 4515; they should also review authentication logs for anomalous wildcard-based login attempts.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Apache documented CVE-2026-94053, a critical authentication-bypass flaw in sshd-ldap caused by unescaped LDAP filter metacharacters; vulnerable configurations could authenticate with "*" as both username and password. The issue affects sshd-ldap deployments in versions 1.2.0–2.19.0 and 3.0.0-M1–M5, and is fixed in versions 2.20.0 and 3.0.0-M6 through RFC 4515-compliant parameter escaping.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcelists.apache.org
Open sourcecve.org
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-48827**, a path traversal flaw in the `org.apache.sshd:sshd-git` bundle of Apache MINA SSHD that lets an SSH-authenticated user escape the configured Git root by supplying repository paths containing traversal sequences such as `../`. The issue affects `sshd-git` versions `2.0.0` through `2.17.1` and `3.0.0-M1` through `3.0.0-M3`, impacting `git-upload-pack`, `git-receive-pack`, and related operations. Successful exploitation can expose arbitrary Git repositories on the server filesystem and, in some cases, allow unauthorized writes outside the intended root. Apache fixed the bug in versions `2.18.0` and `3.0.0-M4` by adding centralized path validation, and noted that deployments using Apache MINA SSHD without the non-default `sshd-git` module are not affected. Apache also disclosed **CVE-2026-35563** in the Apache Directory LDAP API client, where versions `2.0.0` through `2.1.7` failed to verify whether a TLS server certificate matched the intended LDAP hostname. Because the client would accept a trusted certificate issued for an unrelated host, an attacker with man-in-the-middle network access could impersonate the LDAP server and fully compromise the connection. The flaw is tracked as `CWE-297`, and Apache said hostname verification is now enforced in a newer LDAP API release. The disclosures highlight two separate Apache security fixes affecting repository isolation in SSH-based Git services and certificate validation in LDAP client connections.
Jun 29, 2026
Apache disclosed **CVE-2026-56452**, a moderate-severity path traversal flaw in the `sshd-scp` component of **Apache MINA SSHD** that lets a malicious SCP sender write files to attacker-controlled locations during file reception. The issue stems from improper validation of filenames supplied in SCP `C` or `D` commands, creating a risk for applications that use Apache MINA SSHD to receive files over SCP. The vulnerability affects `org.apache.sshd:sshd-scp` through **2.18.0** and **3.0.0-M1** through **3.0.0-M4**. Apache said applications using Apache MINA SSHD **2.0.0 or later** are impacted only if they rely on `sshd-scp` for inbound file transfers, and it released fixes in **2.19.0** and **3.0.0-M5**. The flaw was reported by **Unbbal**.
Jul 20, 2026
Apache disclosed **CVE-2026-49268**, a high-severity LDAP Distinguished Name injection flaw in Apache Shiro’s `DefaultLdapRealm` that can let remote attackers manipulate LDAP bind authentication. The vulnerability is caused by directly concatenating user-supplied usernames into an LDAP DN template without escaping RFC 2253 special characters, allowing an attacker to alter DN construction and potentially bypass authentication or impersonate legitimate users. The issue carries a **CVSS v4 score of 8.8** and is considered remotely exploitable. The flaw affects Apache Shiro `shiro-core` through **2.2.0** and **3.0.0-alpha-0** through **3.0.0-alpha-1** when `DefaultLdapRealm` is in use. Apache said organizations should identify deployments using that realm and upgrade to **2.2.1** or **3.0.0-alpha-2** or later; input escaping for usernames is also recommended. The advisory credited **zhaokaifei of ChinaTelecom** with reporting the issue and **Lenny Primak** with developing the fix.
Jun 29, 2026