Read the docs
TI-2026-63290 Aliases CVE-2026-94053GHSA-qrc3-w53g-j8gv

Apache MINA SSHD: LDAP injection in sshd-ldap

Priority MEDIUM 47CWE-305Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of public key authentication. Other Apache MINA SSHD servers are not affected. Lack of escaping LDAP filter metacharacters enabled successful authentication with username "*" and password "*". Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue by properly escaping filter parameters according to RFC 4515.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00363 30th percentileScored 2026-11-07
Fix Fixed Apache MINA SSHD (Apache Software Foundation): 2.20.0, 3.0.0-M6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache MINA SSHD1.2.0 to before 2.20.0; 3.0.0-M1 to before 3.0.0-M62.20.0, 3.0.0-M6Patch availableCNA
  • Apache MINA SSHD VendorApache Affected 1.2.0 to before 2.20.0; 3.0.0-M1 to before 3.0.0-M6 Fixed in 2.20.0, 3.0.0-M6 Patch available CNA

Remediation

  • Fix · CNA Apache MINA SSHD (Apache Software Foundation) Fixed in 2.20.0, 3.0.0-M6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache MINA SSHD 2.20.0, 3.0.0-M6

    8 records Highest priority Priority MEDIUM 3 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-63289 Apache MINA SSHD: LDAP password authentication ineffectivePriority MEDIUM 47
    • TI-2026-53907 Apache MINA SSHD: Asynchronous authentication can bypass signature verificationPriority MEDIUM 47
    • TI-2026-63260 Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP repliesPriority LOW 39
    Show all 8 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-94053
  2. 2026-10-03 Alias added: GHSA-qrc3-w53g-j8gv

References

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences