LDAP Injection in Apache Shiro
CVE-2026-49268
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users. This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.008 (53.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 53rd percentile — 53.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.008 · change: +0.003
Affected products
- Apache Shiro — versions 3.0.0
- Apache Software Foundation Shiro — versions 0, 3.0.0-alpha-0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread/svszql3od8td7hn6conyj2oq70v53b5s (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Third Party Advisory)
Frequently asked questions
- What is CVE-2026-49268?
- CVE-2026-49268 is a critical-severity vulnerability in Apache Shiro, classified under LDAP Injection. CVSS score: 9.1/10. Published 2026-06-17.
- How severe is CVE-2026-49268?
- Critical severity. CVSS v3 base score is 9.1 out of 10.
- Is CVE-2026-49268 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.