CVE-2026-90979: Apache Karaf: LDAP filter injection in JAAS LDAP login modules
Apache Karaf before 4.4.12 has a moderate LDAP filter injection flaw in its JAAS login modules.
Jean-Baptiste Onofré disclosed CVE-2026-90979, rated moderate, in Apache Karaf JAAS LDAP modules before 4.4.12. LDAPCache and LDAPBackingEngine build user and role search filters by substituting %u, %dn, and %fqdn into administrator-configured userFilter and roleFilter templates. Those values come from the login name, the resolved user DN, and its fully qualified namespace form. The post does not describe in-the-wild exploitation.
- CVE-2026-90979 affects Karaf JAAS LDAP modules before 4.4.12.
- Login name, user DN, and namespace form are inserted into filters.
- The placeholders are %u, %dn, and %fqdn.
- Rated moderate, with no exploitation described.
Vulnerabilities mentionedAll →
- CVE-2026-909797.3—LDAP filter injection in Apache Karaf JAAS loginpublished · Apache Karaf (JAAS LDAPCache and LDAPBackingEngine)
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-90979 | LDAP filter injection in Apache Karaf JAAS login Apache Karaf builds LDAP search filters in LDAPCache and LDAPBackingEngine by substituting login name, user DN, and fully qualified name placeholders (%u, %dn, %fqdn) into administrator-configured userFilter and roleFilter templates. Before the fix, the substituted value was only backslash-escaped, so RFC 4515 metacharacters such as *, (, ), and NUL were not escaped and a crafted name could change the filter structure, widen results, match a different LDAP entry, or over-grant roles. The bug is not reachable through LDAPLoginModule or LDAPPubkeyLoginModule, which already apply correct RFC 4515 encoding, but it is reachable when GSSAPILdapLoginModule or LDAPBackingEngine listRoles pass a name through unescaped. Deployments that use those JAAS LDAP paths with custom filter templates are the ones at risk. There is no known public proof of concept and it is not listed in CISA KEV. |
Posted by Jean-Baptiste Onofré on Sep 28 Severity: moderate Affected versions: - Apache Karaf (org.apache.karaf.jaas.modules.ldap) before 4.4.12 Description: LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator-configured filter templates (userFilter, roleFilter)....
This source does not provide full text. Read it at seclists.org.