CVE-2026-49268: Apache Shiro: LDAP DN Injection in DefaultLdapRealm

Synopsis

LDAP DN injection in Apache Shiro's DefaultLdapRealm class allows a remote, unauthenticated attacker to manipulate the Distinguished Name structure used during LDAP bind authentication. User-supplied usernames are concatenated directly into the DN template without escaping RFC 2253 special characters, letting an attacker craft input that reshapes the DN query. Successful exploitation grants the ability to bypass authentication or impersonate other users in LDAP-backed applications. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment the upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the application's authentication endpoint over the network; no local access or special network position is needed.

• AuthenticationNot required

  No account or credentials are needed; the injection is carried through the username field of a standard unauthenticated login request.

• Victim interactionNot required

  No user action is required; the attacker submits the crafted request directly to the target service.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or environmental prerequisites are required.

Blast Radius

• Reads limited identity or directory attributes exposed through the manipulated LDAP bind response (low confidentiality impact on the vulnerable component).
• Modifies the effective authentication identity, allowing the attacker to log in as a different user including privileged accounts.
• Bypasses authentication gates entirely, granting access to application features and data that require a valid session.