CVE-2026-40193
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
maddy (a composable, all-in-one mail server) versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module. User-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the availability of ldap.EscapeFilter(). An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands, enabling identity spoofing, LDAP directory enumeration, and blind extraction of LDAP attribute values.
Risk Assessment
An attacker can impersonate another user, enumerate the LDAP directory, or extract attribute values, leading to unauthorized access and data disclosure. The risk affects authentication security and directory confidentiality.
Recommendation
Upgrade maddy to version 0.9.3, which fixes this vulnerability. Until then, consider restricting network access to SMTP submission and IMAP interfaces.
Related vulnerabilities
- CVE-2026-118462Critical
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
- CVE-2026-115252Critical
The Confection WordPress Cable plugin from 0.4.0 to 0.4.7 does not perform capability or nonce checks before saving its settings and writes one of them unmodified into a standalone PHP file that it then serves. This allows unauthenticated users to execute arbitrary PHP code on the server.
- CVE-2026-124585Critical
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP devices within the web administration interface. The add_expmac function in var/html/webserver mishandles the mac argument, resulting in OS command injection. The attack can be performed remotely and a public exploit is available.
- CVE-2026-123870Critical
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When GITHUB_WEBHOOK_SECRET is unset or empty (default None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the host.
- CVE-2026-124580Critical
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP version 1.0 B-MB3W202-210825-r11775, affecting the handle_wechat_cn_wifi function in var/html/webserver within the Weixin Auth Endpoint component. Manipulation of the extend argument results in OS command injection. The attack can be executed remotely and the exploit has been made public.
- CVE-2026-124577Critical
A weakness has been identified in Intelbras SG 2404 PoE L2+ versions 1.00.70 and 1.00.72, affecting an unknown function in the /EXCU_SHELL file within the Web Management Interface component. Manipulation can lead to improper authentication. The attack can be launched remotely and the exploit has been made publicly available.
- CVE-2026-113364Critical
Buffer overflow in the data receiving process in NEC WebSAM WinShare versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header.
- CVE-2026-113363Critical
Improper input validation in the network communication processing in NEC WebSAM WinShare versions 7.2.0 through 7.5.0, 7.6.0, and 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer running WinShare.
- CVE-2026-124560Critical
A vulnerability was found in D-Link DIR-878 version 1.20B05 in the GetCAPTCHAsetting function of bin/prog.cgi (HNAP Handler component). Manipulating the uid argument results in a heap-based buffer overflow. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-119506Critical
The Frontend Admin by DynamiApps plugin (acf-frontend-form-element) through version 3.30.1 contains an incorrect privilege assignment vulnerability. The flaw allows an attacker to escalate privileges within the WordPress site.
Original NVD description (English source)
maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the go-ldap/ldap/v3 library's ldap.EscapeFilter() function being available in the same import. This affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths. This issue has been fixed in version 0.9.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS