CVE-2026-35563: Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname

Synopsis

This is a TLS hostname verification bypass in the Apache Directory LDAP API (versions up to and including 2.1.7). The LDAP client validates the certificate chain against a trusted authority but does not check whether the certificate's hostname matches the server it is actually connecting to, allowing an attacker with man-in-the-middle (MITM) position on the network to present any valid certificate from the same trust store and impersonate the intended LDAP server. Successful exploitation gives the attacker full visibility into LDAP traffic and the ability to tamper with directory responses. No fix version has been published upstream yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be positioned on the network path between the LDAP client and server to intercept and modify the TLS handshake (AV:N).

• AuthenticationRequired

  The attacker needs a low-privilege account or equivalent access to initiate or influence the LDAP connection that can be intercepted (PR:L).

• Victim interactionNot required

  No action from a user or victim application is needed once the attacker has MITM position on the network path (UI:N).

• Attack complexityDetail

  Exploitation requires specific pre-conditions: the attacker must have active MITM capability on the network and must possess or obtain a certificate trusted by the client's configured trust store (AC:H, AT:P).

Blast Radius

• The attacker reads all LDAP traffic in plaintext, including authentication credentials, directory queries, and user or group records returned by the server.
• The attacker modifies directory responses in transit, injecting false group memberships, altered user attributes, or fabricated authentication results.
• Downstream systems that rely on LDAP for access control decisions inherit the tampered data, meaning authorization decisions across dependent services are affected (SC:H, SI:L).
• Service availability is not directly impacted by this vulnerability; the LDAP service itself continues to respond normally from the legitimate server's perspective (VA:N, SA:L).