CVE-2026-44930

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/c1zqxppo1m5z3kbdhjn5p991zk09ynkh	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/22/9
https://access.redhat.com/errata/RHSA-2026:37390
https://access.redhat.com/security/cve/CVE-2026-44930
https://bugzilla.redhat.com/show_bug.cgi?id=2480728
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44930.json

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cxf::::::::
	cpe:2.3:a:apache:cxf::::::::
	cpe:2.3:a:apache:cxf:4.2.0:::::::*

History

10 Jul 2026, 12:17

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2026:37390 -

30 Jun 2026, 03:20

Type	Values Removed	Values Added
References		() https://access.redhat.com/security/cve/CVE-2026-44930 - () https://bugzilla.redhat.com/show_bug.cgi?id=2480728 - () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44930.json -

22 May 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-22 13:16

Updated : 2026-07-20 12:19

NVD link : CVE-2026-44930

Mitre link : CVE-2026-44930

CVE.ORG link : CVE-2026-44930

JSON object : View

Products Affected

apache

cxf

CWE

CWE-90

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

{"id": "CVE-2026-44930", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44930", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-22T17:24:05.903573Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache CXF", "versions": [{"status": "affected", "version": "4.2.0", "lessThan": "4.2.1", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.1.6", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "3.6.11", "versionType": "semver"}], "packageName": "org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.18"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16", "versions": [{"status": "unaffected", "version": "repo-ldap", "lessThan": "*", "versionType": "rpm"}], "packageName": "cxf-services-xkms-x509", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_fuse:7"], "vendor": "Red Hat", "product": "Red Hat Fuse 7", "packageName": "cxf-services-xkms-x509-repo-ldap", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "cxf-services-xkms-x509-repo-ldap", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-05-22T13:16:22.820", "references": [{"url": "https://lists.apache.org/thread/c1zqxppo1m5z3kbdhjn5p991zk09ynkh", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/22/9", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2026:37390", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-44930", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480728", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44930.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-90"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-90"}]}], "descriptions": [{"lang": "en", "value": "An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.\u00a0\nUsers are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue."}], "lastModified": "2026-07-20T12:19:29.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DCCE6A7-E66B-4F7B-A2DF-151A03A4E23B", "versionEndExcluding": "3.6.11"}, {"criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06224182-D885-40EA-8521-FBAE6B764742", "versionEndExcluding": "4.1.6", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:apache:cxf:4.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE4A2525-330D-47B0-8DC8-9E389BE58442"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}