CVE-2026-44930
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | 4.2.0 < 4.2.1 | affected |
| Apache Software Foundation | Apache CXF | 4.0.0 < 4.1.6 | affected |
| Apache Software Foundation | Apache CXF | 0 < 3.6.11 | affected |
Weaknesses
- CWE-90: CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
CVE Program Container
Additional References
apache-cxf: org.apache.cxf.services.xkms/cxf-services-xkms-x509-repo-ldap: Apache CXF: Information Disclosure via LDAP Injection
Additional References
- https://access.redhat.com/security/cve/CVE-2026-44930
- https://bugzilla.redhat.com/show_bug.cgi?id=2480728
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44930.json
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.