Loading vulnerability…
LDAP injection authentication bypass in Apache MINA SSHD sshd-ldap
CVE-2026-94053 is an LDAP injection vulnerability in the optional sshd-ldap component of Apache MINA SSHD, a Java SSH client and server library. Failure to escape LDAP filter metacharacters allows authentication to succeed with "*" supplied as both the username and password. Affected versions are 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5. Exposure is limited to SSH servers configured to use sshd-ldap for password or public-key authentication; servers that do not use this component are unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can bypass LDAP-backed SSH authentication and authenticate successfully to an affected server. The resulting authorization scope and access to server resources are not specified; arbitrary code execution, data disclosure, and service disruption are not independently established.
If you can’t patch tonight, do this now.
Until upgraded, disable use of sshd-ldap for password and public-key authentication and use an alternative authentication back end where possible. Restrict access to affected SSH services.
Patch, then assume compromise.
Upgrade affected applications to Apache MINA SSHD 2.20.0 or 3.0.0-M6. These releases escape LDAP filter parameters in accordance with RFC 4515. For affected SUSE deployments, install the apache-sshd package update covered by SUSE-SU-2026:4622-1.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.