Description
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.
This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm
Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Shiro | ≤ 2.2.0, 3.0.0-alpha-0 – ≤ 3.0.0-alpha-1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | shiro | No fix yet | — |
| Debian 13 | shiro | No fix yet | — |
| Debian 12 | shiro | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | shiro | No fix yet | — |
| Ubuntu 26.04 LTS | shiro | No fix yet | — |
| Ubuntu 25.10 | shiro | No fix yet | — |
| Ubuntu 22.04 LTS | shiro | No fix yet | — |
| Ubuntu 20.04 LTS | shiro | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | shiro | No fix yet | — |
| Ubuntu Pro 18.04 LTS | shiro | No fix yet | — |
| Ubuntu Pro 16.04 LTS | shiro | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | neo4j-2026.01 | No fix yet | — |
| Wolfi rolling | neo4j-2026.05 | 2026.05.0-r2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
sassoftware/shiro ★ 2 · Aug 31, 2026
CVE-2026-49268 — Analysis and Remediation of an LDAP Injection Authentication Bypass Vulnerability
-
xiaoqiMikko/shiro-check ★ 0 · Aug 6, 2026
扫出你实际装的 Apache Shiro 模块与版本,逐条判定官方 26 条 CVE 里哪些真的落在你身上。按「CVE × 模块」判定,零依赖单 jar。 CVE-2026-49268
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.shiro:shiro-core | < 2.2.1 | 2.2.1 | GHSA-x96m-rh44-vgv8 |
| Maven | org.apache.shiro:shiro-core | >= 3.0.0-alpha-0, < 3.0.0-alpha-2 | 3.0.0-alpha-2 | GHSA-x96m-rh44-vgv8 |
References
- https://lists.apache.org/thread/svszql3od8td7hn6conyj2oq70v53b5s vendor-advisory