Vulnpedia
← All CVEs

CVE-2026-49268

HIGH 8.8

Published 2026-06-17 · Last modified 2026-06-17

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users. This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.

ELEVATED IMPACT

Severe if exploited (CVSS 8.8), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.5%chance of exploitation in 30 days · 39th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

8.8CVSS 4.0 · HIGH

  • ConfidentialityLow
  • IntegrityHigh
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-49268/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-49268/poc.json

Affected

Vendors Apache Software Foundation Apache

Products Apache Shiro Shiro

Weakness (CWE)

  • CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L/U:Red

Known Affected Software Configurations

VendorProductVersion range
ApacheShiro< 2.2.1
ApacheShiro3.0.0

All CVSS metrics

  • HIGH 8.8 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L/U:Red
  • HIGH 8.8 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:A/V:X/RE:L/U:Red
  • CRITICAL 9.1 v3.1 · NVD Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Advisories

Sources: NVD · CVE.org · EPSS