CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Description
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-90 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-gx55-p8g7-p3fh | CVE-2026-57288 | LOW |
Jenkins Active Directory Plugin has an LDAP injection vulnerability |
2026-09-25 | |
| GHSA-98q5-5qh2-7w75 | CVE-2026-11748 | MODERATE |
Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion |
2026-09-11 | |
| GHSA-xghw-p77p-3r7x | CVE-2026-53658 | MODERATE |
Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter |
2026-08-14 | |
| GHSA-2p3q-h3hg-jcqq | CVE-2026-47303 | HIGH |
Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability |
2026-07-21 | |
| GHSA-g283-w6fp-c4fc | CVE-2026-46745 | MODERATE |
Apache Airflow FAB Auth Manager contains an LDAP filter injection vulnerability |
2026-06-30 | |
| GHSA-pg32-686q-qh6x | CVE-2026-44930 | CRITICAL |
Apache CXF has an LDAP injection vulnerability |
2026-06-29 | |
| GHSA-xq73-fvmr-jvmm | CVE-2026-46619 | HIGH |
OpenAM Authentication Bypass via MSISDN LDAP Injection |
2026-06-26 | |
| GHSA-6mwx-4547-5vc9 | CVE-2026-55770 | MODERATE |
OpenBao: LDAPi ldaputil (wrong escape func) |
2026-06-19 | |
| GHSA-x96m-rh44-vgv8 | CVE-2026-49268 | HIGH |
Apache Shiro: LDAP DN Injection in DefaultLdapRealm |
2026-06-18 | |
| GHSA-cqh3-jg8p-336j | CVE-2026-42568 | MODERATE |
Yamcs Vulnerable to LDAP Injection in LdapAuthModule |
2026-06-11 | |
| GHSA-527g-3w9m-29hv | CVE-2026-40606 | MODERATE |
mitmproxy has an LDAP Injection |
2026-06-06 | |
| GHSA-rxvx-hhpj-q6px | CVE-2026-44671 | HIGH |
ZITADEL has LDAP Filter Injection in Login Flow |
2026-05-15 | |
| GHSA-3r34-vq8m-39gh | CVE-2026-44304 | HIGH |
Lemur: LDAP Filter Injection enables post-authentication privilege escalation |
2026-05-13 | |
| GHSA-c3fc-8qff-9hwx | CVE-2026-0636 | MODERATE |
Bouncy Castle has an LDAP injection |
2026-04-18 | |
| GHSA-5835-4gvc-32pc | CVE-2026-40193 | HIGH |
Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username |
2026-04-16 | |
| GHSA-w83q-mcmx-mh42 | CVE-2026-33751 | MODERATE |
n8n Vulnerable to LDAP Filter Injection in LDAP Node |
2026-03-26 | |
| GHSA-7m6r-fhh7-r47c | CVE-2026-31828 | MODERATE |
Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction |
2026-03-11 | |
| GHSA-3jqf-v4mv-747g | CVE-2026-24130 | LOW |
Moonraker affected by LDAP search filter injection |
2026-01-23 | |
| GHSA-cvf4-f829-762v | CVE-2025-12764 | HIGH |
pgAdmin is affected by an LDAP injection vulnerability |
2025-11-13 | |
| GHSA-4r67-4x4p-fprg | CVE-2025-4573 | MODERATE |
Mattermost allows authenticated administrator to execute LDAP search filter injection |
2025-06-11 | |
| GHSA-qmr3-52xf-wmhx | CVE-2024-31867 | MODERATE |
Apache Zeppelin: LDAP search filter query Injection Vulnerability |
2024-05-02 | |
| GHSA-2x9h-h3c4-wqqh | CVE-2016-9299 | CRITICAL |
Improper Neutralization of Special Elements used in an LDAP Query in Jenkins |
2024-03-12 | |
| GHSA-26cm-qrc6-mfgj | CVE-2021-41232 | HIGH |
Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker |
2024-02-08 | |
| GHSA-8hc5-rmgf-qx6p | CVE-2022-2232 | LOW |
Keycloak vulnerable to LDAP Injection on UsernameForm Login |
2023-11-29 | |
| GHSA-w66j-xc7r-m2jv | CVE-2022-45046 | CRITICAL |
camel-ldap component allows LDAP Injection when using the filter option |
2022-12-06 |