DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-11748: CVE-2026-11748: Unauthenticated LDAP Injection in Central Dogma Server Authentication

#security #cve #cybersecurity

CVE-2026-11748: Unauthenticated LDAP Injection in Central Dogma Server Authentication

Vulnerability ID: CVE-2026-11748
CVSS Score: 6.9
Published: 2026-09-11

An LDAP injection vulnerability exists in the centraldogma-server-auth-shiro module of LY Corporation Central Dogma before version 0.84.0. The search logic dynamically constructs LDAP search filters by interpolating user-provided usernames without escaping RFC 4515 metacharacters. Unauthenticated remote attackers can leverage this flaw to bypass authentication, enumerate directory hierarchies, and access unauthorized resources.

TL;DR

Unauthenticated LDAP injection in LY Corporation Central Dogma before version 0.84.0 allows remote attackers to bypass authentication and query directory contents due to unsafe handling of RFC 4515 metacharacters in username fields.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-90
  • Attack Vector: Network
  • CVSS v4.0: 6.9 (Medium)
  • EPSS Score: 0.00618 (Percentile: 47.64%)
  • Impact: Authentication Bypass / Directory Enumeration
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • LY Corporation Central Dogma centraldogma-server-auth-shiro module
  • Central Dogma: < 0.84.0 (Fixed in: 0.84.0)

Code Analysis

Commit: f78719f

Fix LDAP injection vulnerability in SearchFirstActiveDirectoryRealm.java by introducing RFC 4515 character escaping.

Exploit Details

  • GitHub: Advisory text containing detailed explanation of regression test suites and escaping scenarios used to prove the injection vulnerability

Mitigation Strategies

  • Upgrade the Central Dogma installation to version 0.84.0 or above.
  • Implement WAF input validation rules to block the execution of LDAP control characters in authentication queries.
  • Disable unauthenticated binds on the backend LDAP/Active Directory controllers.
  • Enforce least-privilege access permissions on the directory service account utilized by the Central Dogma server.

Remediation Steps:

  1. Identify all deployment nodes running Central Dogma versions prior to 0.84.0.
  2. Update dependencies in build.gradle or pom.xml to target centraldogma-server-auth-shiro version 0.84.0.
  3. Recompile and redeploy the Central Dogma server services.
  4. Validate the fix by attempting to log in with wildcard characters (e.g., '' and 'admin)(objectClass=*') to verify they are rejected or treated as literal characters.

References

Read the full report for CVE-2026-11748 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)