Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-10549 EUVD-2026-33900GHSA-4x3h-p6xh-h5x5

Privilege escalation in Yandex Database

Published Jun 2, 2026 · Updated Jun 2, 2026 · Assigned by yandex

Description

LDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote attacker with valid LDAP credentials to bypass group membership checks resulting in unauthorized access to the database.

Affected products

VendorProductAffectedFixed
Yandex Yandex Database < 25.3.1.25 25.3.1.25

References