Loading vulnerability…
LDAP DN Injection in Apache Shiro DefaultLdapRealm
CVE-2026-49268 is an LDAP Distinguished Name (DN) injection vulnerability in Apache Shiro's DefaultLdapRealm class. User-supplied usernames are concatenated directly into an LDAP DN template without escaping RFC 2253 special characters. A remote attacker can submit a crafted username to alter the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating another user. The vulnerability affects Apache Shiro versions through 2.2.0 and versions 3.0.0-alpha-0 through 3.0.0-alpha-1 when DefaultLdapRealm is used.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can potentially bypass LDAP-backed authentication or permit user impersonation, granting unauthorized access to application resources and operations available to the impersonated identity. This can compromise the confidentiality and integrity of protected data. Arbitrary code execution and direct availability impact are not established.
If you can’t patch tonight, do this now.
Until patched, restrict untrusted access to authentication endpoints using the affected DefaultLdapRealm configuration. Avoid the vulnerable DN construction where feasible. Monitor LDAP authentication logs for malformed DNs, unusual login patterns, and suspicious successful authentications. These controls reduce exposure or assist detection but do not replace upgrading.
Patch, then assume compromise.
Upgrade Apache Shiro to version 2.2.1 or later in the 2.x branch, or 3.0.0-alpha-2 or later in the 3.x branch. These releases escape user-supplied DN input to prevent manipulation of the DN structure. Update affected applications and bundled dependencies to incorporate the fixed release. VMware Tanzu GemFire deployments should upgrade to version 10.3.0, which includes a fix for this CVE.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.