CVE-2026-49268: Apache Shiro LDAP DN Injection in DefaultLdapRealm
CVE-2026-49268 is an LDAP injection flaw in the DefaultLdapRealm class of Apache Shiro. Usernames are concatenated into the LDAP Distinguished Name without escaping RFC 2253 special characters, which can alter bind authentication. The record describes fixes in Apache Shiro 2.2.1 and 3.0.0-alpha-2, and no confirmed exploitation appears in the sources consulted.
Overview
Apache Shiro is a Java security framework. This record concerns the DefaultLdapRealm class, where username input is concatenated into an LDAP Distinguished Name template without escaping RFC 2253 special characters. The weakness is classified as CWE-90 (LDAP Injection) and was published by the Apache CNA on 2026-06-17.
Impact
According to the record, a remote party who controls the username value may alter the DN used during LDAP bind authentication. The record associates this with possible authentication bypass or impersonation of other users. NVD lists a CVSS 3.1 base score of 9.1 (critical), with high confidentiality and integrity impact, and Apache lists a CVSS 4.0 score of 8.8 in the record.
Affected products and versions
- Apache Shiro through 2.2.0, when using DefaultLdapRealm.
- Apache Shiro 3.0.0-alpha-0 up to and including 3.0.0-alpha-1, when using DefaultLdapRealm.
- The affected range also includes versions before 2.2.1 according to the structured version data.
Fixed versions named in the record are 2.2.1 and 3.0.0-alpha-2 or later. The fixes field of the record is empty, so the fix information comes from the description text.
Exploitation status
The record is not listed in the CISA KEV catalog, so this analysis does not report active exploitation. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is none and the automatable field is yes. The EPSS probability is 0.00755 with a percentile of 0.54649.
Remediation and mitigation
- Upgrade Apache Shiro to 2.2.1, or to 3.0.0-alpha-2 or later, as stated in the record.
- If an immediate upgrade is not possible, review whether DefaultLdapRealm is in use and limit exposure of the authentication endpoints that depend on it.
- Ensure that user-supplied values used to build LDAP queries or DNs are escaped according to the LDAP rules in the application code, in addition to the library fix.
Detection guidance
- Review authentication logs for bind attempts with unusual usernames containing LDAP special characters or unexpected DN structures.
- Monitor for successful logins from accounts that do not match the expected user population.
- Compare directory bind activity against baseline patterns for the application.
Limitations of the available information
The record does not include a fixes list, so the fix versions depend on the description text. The structured version data includes an entry whose format differs from the others, and this analysis does not rely on it. The sources consulted do not describe a proof of concept or exploitation details, and the record does not state whether other supported branches are affected.
Frequently asked questions
What is the core weakness in CVE-2026-49268?
Username input is concatenated into an LDAP Distinguished Name in the DefaultLdapRealm class without escaping RFC 2253 special characters, which is classified as CWE-90 LDAP Injection.
Which Apache Shiro versions are fixed?
According to the record description, upgrading to 2.2.1 or to 3.0.0-alpha-2 or later fixes the issue. The record's fixes field is empty, so administrators should confirm with the vendor advisory.
Is this vulnerability known to be actively exploited?
The record is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.