CVE-2026-90979
Description
A flaw was found in Apache Karaf. When constructing Lightweight Directory Access Protocol (LDAP) search filters for user and role lookups, the application fails to properly escape special characters in user-supplied input. A remote attacker can exploit this vulnerability by submitting a crafted username containing LDAP control characters during authentication, altering the search query logic. This may cause queries to match unintended directory records, potentially leading to privilege escalation through unauthorized role assignments or improper account access.
Statement
This vulnerability is rated as Moderate impact for Red Hat deployments because successful exploitation depends on specific, non-default authentication configurations where input sanitization is omitted. In typical JAAS deployments using standard LDAP login modules, usernames undergo encoding prior to filter substitution, inherently neutralizing injection attempts. The risk is constrained to environments utilizing unencoded entry points such as GSSAPI-based LDAP authentication or programmatic role lookups, which require specific directory schema and filter templates to alter access controls.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 7.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | Low |
| Integrity Impact | High | N/A | Low |
| Availability Impact | None | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands; Read Application Data; Modify Application Data
An attacker could include input that changes the LDAP query which allows unintended commands or code to be executed, allows sensitive data to be read or modified or causes other unintended behavior.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
