MEDIUM GitHub
CVE-2026-11748
Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion
# Vulnerability
`SearchFirstActiveDirectoryRealm.findUserDn()` substitutes the user-supplied username from the login form into an LDAP search filter template (default `cn={0}`) **without escaping RFC 4515 filter metacharacters** (`*`, `(`, `)`, `\`, NUL). Combined with `SearchControls.setCountLimit(1)` on the same call site, this allows three distinct attack primitives:
1. **Authentication confusion** — typing username `*` causes the realm to construct filter `cn=*`, return the first directory
Affected Products
- maven/com.linecorp.centraldogma:centraldogma-server-auth-shiro < 0.84.0
References
- https://github.com/advisories/GHSA-98q5-5qh2-7w75
- https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75
- https://nvd.nist.gov/vuln/detail/CVE-2026-11748
- https://github.com/advisories/GHSA-98q5-5qh2-7w75
This medium severity vulnerability was published on 2026-09-11 via GitHub. Affected: maven/com.linecorp.centraldogma:centraldogma-server-auth-shiro < 0.84.0.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.