CVE-2026-41720: Authentication Bypass with Empty Password in Spring LDAP

Synopsis

Authentication bypass in Spring LDAP affects versions 2.4.0-2.4.4, 3.2.0-3.2.17, 3.3.0-3.3.7, and 4.0.0-4.0.3. The flaw is reachable over the network with no credentials required, though exploitation requires meeting specific conditions (high attack complexity per the CVSS vector); a non-empty username paired with an empty or null password is accepted as a valid bind by the DirContextAuthenticationStrategy implementations, bypassing authentication entirely. Successful exploitation allows an attacker to read protected data and tamper with directory-backed resources. Patched-image rebuilds at versions 2.4.5, 3.2.18, 3.3.8, and 4.0.4 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable Spring LDAP bind endpoint must be reachable over the network; an attacker submits a crafted authentication request remotely.

• AuthenticationNot required

  No existing credentials are needed; the attacker supplies only a non-empty username with an empty or null password to trigger the bypass.

• Victim interactionNot required

  No user action or social engineering is required; the attacker interacts directly with the service endpoint.

• Attack complexityDetail

  Attack complexity is rated HIGH, meaning the attacker must satisfy specific environmental or timing conditions beyond simple network access, such as targeting a deployment that relies on LDAP bind for authentication without additional validation layers.

Blast Radius

• Reads directory-backed resources, including user account attributes, group memberships, and any data exposed through the LDAP tree to authenticated sessions.
• Modifies directory entries if the LDAP account being impersonated carries write permissions, including user profile data or access-control group assignments.
• Gains the effective access level of any account whose username is known, bypassing password enforcement entirely for those accounts.