CVE-2026-49268— Apache Shiro: LDAP DN Injection in DefaultLdapRealm
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Shiro | ≤ 2.2.0 | affected |
3.0.0-alpha-0≤ 3.0.0-alpha-1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49268
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
Source: NVD (National Vulnerability Database)
Vulnerability Description
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users. This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
LDAP查询中使用的特殊元素转义处理不恰当(LDAP注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache shiro 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache shiro是美国Apache基金会开源的一个安全权限框架。 Apache Shiro 2.2.0及之前版本和3.0.0-alpha-1版本存在输入验证错误漏洞，该漏洞源于DefaultLdapRealm类中未对RFC 2253特殊字符进行转义，用户输入的用户名直接拼接至LDAP DN模板，可能导致攻击者绕过身份验证或冒充其他用户。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Shiro | 0 ~ 2.2.0 | - |
II. Public POCs for CVE-2026-49268
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49268
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-49268 (1)
Same Patch Batch · Apache Software Foundation · 2026-06-17 · 7 CVEs total
| CVE-2026-47340 | Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated use | |
| CVE-2026-32967 | Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks | |
| CVE-2026-42357 | Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access work | |
| CVE-2026-41280 | Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system lo | |
| CVE-2026-32966 | Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Dat | |
| CVE-2026-50203 | Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local f |
IV. Related Vulnerabilities
Same product: Apache Shiro
- CVE-2026-56091
Apache Shiro: Authentication bypass in Guice-Web integration - CVE-2026-56130
Apache Shiro: Remember-me cookie isn't checked for expiry on - CVE-2026-48589
Apache Shiro: Jakarta EE open redirect via untrusted Referer - CVE-2026-43828
Apache Shiro: Shiro's native session and rememberMe cookies - CVE-2026-43827
Apache Shiro: Session fixation: new session is not created a
Same vendor: Apache Software Foundation
- CVE-2026-49844
Apache Log4j API: Improper serialization of non-finite float - CVE-2026-40454
Apache IoTDB C++ client: Out-of-bounds reads in C++ client T - CVE-2026-40452
Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery - CVE-2026-40009
Apache IoTDB: Authenticated users can escalate to full tree- - CVE-2026-40008
Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfe
Same weakness: CWE-90
- CVE-2026-4256
LDAP Injection in PEAKUP's PassGate - CVE-2026-13696
LDAP Injection in HAVELSAN's Liman MYS - CVE-2026-42568
Yamcs Vulnerable to LDAP Injection in LdapAuthModule - CVE-2026-45559
Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only - CVE-2026-46745
Apache Airflow FAB provider: LDAP Filter Injection in FAB Au
V. Comments for CVE-2026-49268
No comments yet