CVE-2026-116200: Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()

Q: Which deployments are exposed to this downgrade attack?

Snipe-IT deployments before 8.6.3 that use LDAP with StartTLS are exposed when an attacker can act on-path between Snipe-IT and the LDAP service. The attacker can cause StartTLS negotiation to fail while the application continues with a cleartext LDAP bind.

Q: What access does an attacker need?

No Snipe-IT account or user interaction is required. The attacker must be able to intercept or manipulate network traffic between Snipe-IT and its LDAP server and respond to the StartTLS request with a protocol error.

Q: What credentials could be exposed?

An on-path attacker may capture the LDAP service-account credentials used by Snipe-IT. They may also capture end-user login passwords sent during LDAP authentication after the forced downgrade.

Q: What is the remediation?

Upgrade Snipe-IT to version 8.6.3 or later. The affected behavior applies to versions before 8.6.3.

Published Oct 25, 2026

Updated

Snipe-IT before 8.6.3 ignores the ldapstarttls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.

Affected Software

1 affected component

Snipe-IT Snipe-IT<8.6.3

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this downgrade attack?

Snipe-IT deployments before 8.6.3 that use LDAP with StartTLS are exposed when an attacker can act on-path between Snipe-IT and the LDAP service. The attacker can cause StartTLS negotiation to fail while the application continues with a cleartext LDAP bind.

What access does an attacker need?

No Snipe-IT account or user interaction is required. The attacker must be able to intercept or manipulate network traffic between Snipe-IT and its LDAP server and respond to the StartTLS request with a protocol error.

What credentials could be exposed?

An on-path attacker may capture the LDAP service-account credentials used by Snipe-IT. They may also capture end-user login passwords sent during LDAP authentication after the forced downgrade.

What is the remediation?

Upgrade Snipe-IT to version 8.6.3 or later. The affected behavior applies to versions before 8.6.3.

CVE-2026-116200: Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this downgrade attack?

What access does an attacker need?

What credentials could be exposed?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this downgrade attack?

What access does an attacker need?

What credentials could be exposed?

What is the remediation?