CVE-2026-49268: Apache Shiro shiro-core LDAP DN Injection Vulnerability
Summary
CVE-2026-49268: Apache Shiro: LDAP DN Injection in DefaultLdapRealm. Affects org.apache.shiro:shiro-core across 2 version ranges.
< 2.2.1
>= 3.0.0-alpha-0, < 3.0.0-alpha-2
Fixed in 2.2.1 or 3.0.0-alpha-2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Shiro is a powerful and flexible open-source security framework that provides authentication, authorization, cryptography, and session management for Java applications. It is widely used due to its ease of integration and comprehensive security features. However, certain versions of the shiro-core package are vulnerable to LDAP DN injection, which can compromise the security of applications relying on LDAP for user authentication.
Vulnerability Detail
The vulnerability arises from the DefaultLdapRealm class within Apache Shiro, where user-supplied username input is directly concatenated into the LDAP Distinguished Name (DN) template without proper escaping of special characters as defined by RFC 2253. This flaw allows remote attackers to inject LDAP special characters, potentially manipulating the DN structure used for LDAP bind authentication. As a result, attackers could bypass authentication mechanisms or impersonate legitimate users, leading to unauthorized access and data breaches.
How To Fix
Latest published version: 3.0.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.12.2.1 -
>= 3.0.0-alpha-0, < 3.0.0-alpha-23.0.0-alpha-2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that user input is validated and sanitized before being used in LDAP operations. Implementing strict input validation can help mitigate the risk of LDAP injection until the library is updated.
Conclusion
The LDAP DN Injection vulnerability in Apache Shiro's shiro-core package poses a significant risk to applications relying on LDAP for authentication. It is crucial for developers to upgrade to the latest patched versions to safeguard against potential attacks. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for org.apache.shiro:shiro-core →
FAQ
LDAP DN Injection is a type of attack where an attacker manipulates the Distinguished Name (DN) used in LDAP queries, potentially allowing unauthorized access or impersonation of users.
All Apache Shiro versions through 2.2.0 and 3.0.0-alpha-1 are affected by this vulnerability when using DefaultLdapRealm.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By analyzing your pom.xml file, Vulert can determine if your application is affected by this vulnerability.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If immediate upgrading is not possible, implement input validation and sanitization as a temporary measure to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.shiro:shiro-core.
