Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90979— Apache Karaf: LDAP filter injection in JAAS LDAP login modules

Quick assessment

Affected
Apache Software Foundation Apache Karaf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： --- LDAPCache 和 LDAPBackingEngine 在构建用于用户查找和角色查找的 LDAP 搜索过滤器时，通过将占位符 、 和 （分别取自登录名、已解析的用户 DN 及其完全限定的命名空间形式）文本替换到管理员配置的过滤器模板（ 、 ）中。在修复之前，对替换值施加的唯一 sanitization（净化/转义）操作仅为双反斜杠处理： 这种处理方式并未按照 RFC 4515 的要求对 LDAP 搜索过滤器中需要转义的其他字符（如 、 、 和 NUL）进行转义。如果登录

AI Predicted 6.5 Difficulty: Hard

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90979

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Karaf: LDAP filter injection in JAAS LDAP login modules
Source: CVE Program / CVE List V5
Vulnerability Description
LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator-configured filter templates (userFilter, roleFilter). Before the fix, the only sanitization applied to the substituted value was double backslashed: filter = filter.replaceAll(Pattern.quote("%u"), Matcher.quoteReplacement(user)); filter = filter.replace("\\", "\\\\"); This does not escape the other characters RFC 4515 requires escaping in an LDAP search filter: *, (, ), and NUL. A login name containing any of these can change the structure of the resulting filter rather than being matched as a literal value (e.g. a crafted username can turn an equality match into a wildcard match, or close/reopen filter clauses), widening what the search returns and potentially causing a login or role lookup to match an LDAP entry other than the intended one, over-granting roles, and depending on deployment-specific filter templates, potentially affecting which account a login resolved to. It's not exploitable through every entry points: LDAPLoginModule and LDAPPubkeyLoginModule both called Util.doRFC2254Encoding() (correct RFC 4515 escaping) on the login name before handing it to LDAPCache, which masked the missing escaping in LDAPCache for those two call paths. Using LDAPCache directly (bypassing the login modules) does not reproduce through the normal LDAPLoginModule/LDAPPubkeyLoginModule authentication flow for this reason. It does reproduce through two other call paths that reach LDAPCache/LDAPBackingEngine without any prior escaping: * GSSAPILdapLoginModule passes the NameCallback name straight through, unescaped. * LDAPBackingEngine (listRoles) passes principal.getName() straight through, unescaped.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
LDAP查询中使用的特殊元素转义处理不恰当(LDAP注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Karaf 0 ~ 4.4.12 -

II. Public POCs for CVE-2026-90979

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90979

请登录查看更多情报信息。

Other References for CVE-2026-90979 (1)

Same Patch Batch · Apache Software Foundation · 2026-09-28 · 20 CVEs total

CVE-2026-82377 9.9 CRITICAL Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
CVE-2026-82384 9.8 CRITICAL Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
CVE-2026-82378 9.0 CRITICAL Apache Roller: OAuth authorization endpoint trusts request-supplied identity
CVE-2026-82383 8.2 HIGH Apache Roller: Anonymous setup action allows frontpage configuration tampering
CVE-2026-82380 8.1 HIGH Apache Roller: CSRF protection bypass via self-generated salt validation
CVE-2026-82379 7.7 HIGH Apache Roller: WSSE digest authentication headers can be replayed
CVE-2026-82348 7.7 HIGH Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups
CVE-2026-82376 7.7 HIGH Apache Roller: XML external entity processing in trackback response parser
CVE-2026-82386 7.7 HIGH Apache Roller: XML external entity processing in OPML bookmark import
CVE-2026-82375 7.4 HIGH Apache Roller: Server-side request forgery via entry trackback and enclosure URLs
CVE-2026-82385 6.5 MEDIUM Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath fi
CVE-2026-91206 6.1 MEDIUM Apache Roller: Reflected XSS in the optional LDAP comment authenticator
CVE-2026-91204 6.1 MEDIUM Apache Roller: Stored javascript: URI in HTML comments
CVE-2026-82546 6.1 MEDIUM Apache Roller: Stored cross-site scripting through incoming Trackback links
CVE-2026-82382 6.1 MEDIUM Apache Roller: Reflected cross-site scripting in the frontpage directory parameter
CVE-2026-86507 6.1 MEDIUM Apache Roller: Stored XSS in comment moderation via comment author URL
CVE-2026-82387 5.4 MEDIUM Apache Roller: Stored cross-site scripting via uploaded media content type
CVE-2026-82381 5.4 MEDIUM Apache Roller: Stored cross-site scripting in the authoring UI
CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

IV. Related Vulnerabilities

Same product: Apache Karaf
Same vendor: Apache Software Foundation
Same weakness: CWE-90

V. Comments for CVE-2026-90979

No comments yet

Leave a comment