Vulnerability · Published Jun 17, 2026 · Assigned by apache
CVE-2026-49268Apache Shiro: LDAP DN Injection in DefaultLdapRealm
High 8.8
In plain English
A high-severity security flaw in Apache Shiro from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users. This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | shiro | no fix listed | DEBIAN-CVE-2026-49268 |
| Debian:13 | shiro | no fix listed | DEBIAN-CVE-2026-49268 |
| Debian:14 | shiro | no fix listed | DEBIAN-CVE-2026-49268 |
| Maven | org.apache.shiro:shiro-core | 2.2.1 | GHSA-x96m-rh44-vgv8 |
| Maven | org.apache.shiro:shiro-core | 3.0.0-alpha-2 | GHSA-x96m-rh44-vgv8 |
| Ubuntu:22.04:LTS | shiro | no fix listed | UBUNTU-CVE-2026-49268 |
| Ubuntu:25.10 | shiro | no fix listed | UBUNTU-CVE-2026-49268 |
| Ubuntu:26.04:LTS | shiro | no fix listed | UBUNTU-CVE-2026-49268 |
| Ubuntu:26.10 | shiro | no fix listed | UBUNTU-CVE-2026-49268 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Shiro | 0 – through 2.2.03.0.0-alpha-0 – through 3.0.0-alpha-1 |
Weakness: CWE-90 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L/U:Red