Loading vulnerability…
LDAP Injection in Apache CXF XKMS LDAP Certificate Repository
CVE-2026-44930 is an LDAP injection vulnerability in the LDAP Certificate repository component of the XKMS server in Apache CXF, specifically the cxf-services-xkms-x509-repo-ldap module. The flaw is caused by insufficient sanitization and validation of user-controlled input used to construct backend LDAP search queries or filters during certificate lookup operations. By supplying crafted input to a vulnerable XKMS endpoint, an attacker can manipulate LDAP queries and cause the repository to return certificates outside the intended scope. The issue affects Apache CXF 4.2.0 before 4.2.1, 4.0.0 through 4.1.5, and versions before 3.6.11. Fixed releases are 4.2.1, 4.1.6, and 3.6.11.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized retrieval or enumeration of arbitrary digital certificates stored in the LDAP-backed certificate repository. This is an information disclosure issue that can expose cryptographic assets and metadata associated with other users or services. Although the vulnerability does not directly provide remote code execution, access to certificates can support impersonation, facilitate interception or abuse of trust relationships, and aid follow-on activity such as lateral movement or broader compromise of certificate-dependent enterprise workflows.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of XKMS services to untrusted users and networks, restrict access to certificate lookup functionality, and tighten LDAP-side access controls so the service account can only read the minimum required certificate objects. Monitor certificate access and directory query activity for anomalous retrieval patterns. No complete workaround is documented; upgrading remains the primary mitigation.
Patch, then assume compromise.
Upgrade Apache CXF to a fixed release that addresses the LDAP injection flaw in the XKMS LDAP certificate repository. The vendor-recommended fixed versions are 4.2.1, 4.1.6, and 3.6.11, depending on the deployed branch. Ensure the vulnerable XKMS LDAP certificate repository component is updated as part of the Apache CXF installation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.