CVE-2026-94052: Apache MINA SSHD: LDAP password authentication ineffective
CVE-2026-94052 (CVSS 9.1) lets unauthenticated attackers bypass LDAP password authentication in Apache MINA SSHD sshd-ldap.
A missing check in LdapPasswordAuthenticator in the sshd-ldap component of Apache MINA SSHD bypasses authentication checks. The flaw, CVE-2026-94052, is rated critical with CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N) with high confidentiality and integrity impact. Affected versions are 1.2.0 before 2.20.0 and 3.0.0-M1 before 3.0.0-M6; users should upgrade to 2.20.0 or 3.0.0-M6.
- Authentication bypass in LdapPasswordAuthenticator rated critical CVSS 9.1
- Network-exploitable with no privileges or user interaction required
- Affects sshd-ldap 1.2.0-2.19.0 and 3.0.0-M1-3.0.0-M5
- Fixed in 2.20.0 and 3.0.0-M6
Vulnerabilities mentionedAll →
- CVE-2026-940529.1—Authentication Bypass via LdapPasswordAuthenticator in Apache MINA SSHDpublished · Apache MINA SSHD (sshd-ldap optional component, LdapPasswordAuthenticator)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-94052 | Authentication Bypass via LdapPasswordAuthenticator in Apache MINA SSHD Apache MINA SSHD, a Java library for building SSH clients and servers, fails to properly enforce password checks in the optional sshd-ldap component: a missing check in LdapPasswordAuthenticator makes LDAP-backed password authentication ineffective, so an unauthenticated network attacker can log in without valid credentials. The flaw is triggered when an SSH server built on Apache MINA SSHD versions 1.2.0–2.19.0 or 3.0.0-M1–3.0.0-M5 configures LdapPasswordAuthenticator for password authentication, and successful exploitation grants the attacker the privileges of an LDAP-listed user, compromising confidentiality and integrity of the server. Servers using the built-in sshd-core password mechanisms are not affected, and neither are deployments that do not use sshd-ldap at all. The issue is rated critical (CVSS 9.1) and fixed in versions 2.20.0 and 3.0.0-M6. No public proof-of-concept exists, the CVE is not in CISA's KEV catalog, and no exploitation has been observed in the wild to date. |
Posted by Thomas Wolf on Sep 29 Severity: critical CVSS 3.1: 9.1 (critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected versions: - Apache MINA SSHD 1.2.0 before 2.20.0 - Apache MINA SSHD 3.0.0-M1 before 3.0.0-M6 Description: A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and...
This source does not provide full text. Read it at seclists.org.