CVE-2026-49268: Apache Shiro: LDAP DN Injection in DefaultLdapRealm
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.
This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.shiro:shiro-coreto a version that resolves this vulnerability.Fixed in 3.0.0-alpha-2 - Upgrade
Upgrade
maven/org.apache.shiro:shiro-coreto a version that resolves this vulnerability.Fixed in 2.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49268?
CVE-2026-49268 has a high severity rating of 8.8 according to the CVSS.
What kind of attack is possible with CVE-2026-49268?
CVE-2026-49268 allows remote attackers to perform LDAP DN injection attacks through specially crafted usernames.
How can I mitigate CVE-2026-49268?
To mitigate CVE-2026-49268, validate and sanitize user inputs to prevent the injection of special LDAP characters.
Which software is affected by CVE-2026-49268?
CVE-2026-49268 affects Apache Shiro, particularly the DefaultLdapRealm class.
Is there an official fix for CVE-2026-49268?
An official fix for CVE-2026-49268 should be sought from the latest updates or patches provided by Apache Shiro.