identity-authentication-vulnerabilityinternet-facing-service-vulnerabilitywidely-deployed-product-advisoryinitial-access-method

Critical LDAP Authentication Bypass in Apache MINA SSHD

Vulnerability Disclosure · 4 sources · Updated 2mo ago · First seen Sep 30, 2026

Apache disclosed CVE-2026-94053, a critical LDAP injection flaw in the optional sshd-ldap component of Apache MINA SSHD. SSH servers using this component for password or public-key authentication can allow unauthenticated remote login because LDAP filter metacharacters were not escaped; an attacker can authenticate with * as both the username and password. The vulnerability is rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is classified as CWE-90 and CWE-305.

Affected releases are Apache MINA SSHD 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5, but exposure is limited to deployments that have configured sshd-ldap authentication. Organizations should identify internet-reachable and internal SSH services using this integration and upgrade to 2.20.0 or 3.0.0-M6, which escape LDAP filter parameters in accordance with RFC 4515; they should also review authentication logs for anomalous wildcard-based login attempts.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

1 event

Reported Sep 30, 20262mo ago
Apache MINA SSHD LDAP injection flaw fixed
Apache documented CVE-2026-94053, a critical authentication-bypass flaw in sshd-ldap caused by unescaped LDAP filter metacharacters; vulnerable configurations could authenticate with "*" as both username and password. The issue affects sshd-ldap deployments in versions 1.2.0–2.19.0 and 3.0.0-M1–M5, and is fixed in versions 2.20.0 and 3.0.0-M6 through RFC 4515-compliant parameter escaping.
CVE-2026-94053 - Apache MINA SSHD: LDAP injection in sshd-ldap

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

LDAP injection authentication bypass in Apache MINA SSHD sshd-ldap (CVE-2026-94053)

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Sep 30, 2026

CVE-2026-94053 - Apache MINA SSHD: LDAP injection in sshd-ldapOpen source ↗

Lists ApacheNews · Sep 29, 2026

CVE-2026-94053: Apache MINA SSHD: LDAP injection in sshd-ldap - ASF Mailing List ArchivesOpen source ↗

CveAdvisories · Sep 29, 2026

CVE Record: CVE-2026-94053Open source ↗

OpenwallNews · Sep 29, 2026

oss-security - CVE-2026-94053: Apache MINA SSHD: LDAP injection in sshd-ldapOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Critical LDAP Authentication Bypass in Apache MINA SSHD

How this story unfolded

Apache MINA SSHD LDAP injection flaw fixed

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Apache fixes MINA SSHD path traversal and LDAP TLS hostname verification flaws

Path Traversal in Apache MINA SSHD SCP File Reception

Apache Shiro DefaultLdapRealm Flaw Enables LDAP Injection and Authentication Bypass

Critical LDAP Authentication Bypass in Apache MINA SSHD

How this story unfolded

Apache MINA SSHD LDAP injection flaw fixed

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Apache fixes MINA SSHD path traversal and LDAP TLS hostname verification flaws

Path Traversal in Apache MINA SSHD SCP File Reception

Apache Shiro DefaultLdapRealm Flaw Enables LDAP Injection and Authentication Bypass