CVE-2026-94053: Apache MINA SSHD: LDAP injection in sshd-ldap

Apache MINA SSHD, a Java SSH client/server library, contains an LDAP injection flaw (CWE-90) in its optional sshd-ldap component spanning versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Because the component fails to escape LDAP filter metacharacters, an unauthenticated attacker can authenticate to an affected SSH server by submitting a username of "*" and a password of "*", which causes the LDAP query to match unintended entries. A successful login grants the attacker a valid SSH session with high impact on confidentiality and integrity (CVSS 9.1), meaning potential access to whatever the server exposes — SFTP file trees, forwarded services, or shell access depending on the embedding application. Only SSH servers built on MINA SSHD that explicitly configure sshd-ldap for password or public key authentication are vulnerable; other MINA SSHD deployments are not affected. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported.