CVE-2026-24130

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24130", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-21T18:38:22.474Z", "datePublished": "2026-01-22T22:53:34.769Z", "dateUpdated": "2026-01-23T20:03:49.510Z"}, "containers": {"cna": {"title": "Moonraker with LDAP Enabled Allows Malicious Search Filter Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-90", "lang": "en", "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-209", "lang": "en", "description": "CWE-209: Generation of Error Message Containing Sensitive Information", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/Arksine/moonraker/security/advisories/GHSA-3jqf-v4mv-747g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Arksine/moonraker/security/advisories/GHSA-3jqf-v4mv-747g"}, {"name": "https://github.com/Arksine/moonraker/commit/74c5d8e44c4a4abbfbb06fb991e7ebb9ac947f42", "tags": ["x_refsource_MISC"], "url": "https://github.com/Arksine/moonraker/commit/74c5d8e44c4a4abbfbb06fb991e7ebb9ac947f42"}], "affected": [{"vendor": "Arksine", "product": "moonraker", "versions": [{"version": "< 0.10.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T22:53:34.769Z"}, "descriptions": [{"lang": "en", "value": "Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the \"ldap\" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. This issue has been fixed in version 0.10.0."}], "source": {"advisory": "GHSA-3jqf-v4mv-747g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T20:03:39.265186Z", "id": "CVE-2026-24130", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T20:03:49.510Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24130", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T20:03:39.265186Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T20:03:45.816Z"}}], "cna": {"title": "Moonraker with LDAP Enabled Allows Malicious Search Filter Injection", "source": {"advisory": "GHSA-3jqf-v4mv-747g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "Arksine", "product": "moonraker", "versions": [{"status": "affected", "version": "< 0.10.0"}]}], "references": [{"url": "https://github.com/Arksine/moonraker/security/advisories/GHSA-3jqf-v4mv-747g", "name": "https://github.com/Arksine/moonraker/security/advisories/GHSA-3jqf-v4mv-747g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Arksine/moonraker/commit/74c5d8e44c4a4abbfbb06fb991e7ebb9ac947f42", "name": "https://github.com/Arksine/moonraker/commit/74c5d8e44c4a4abbfbb06fb991e7ebb9ac947f42", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the \"ldap\" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. This issue has been fixed in version 0.10.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-90", "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "CWE-209: Generation of Error Message Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T22:53:34.769Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24130", "state": "PUBLISHED", "dateUpdated": "2026-01-23T20:03:49.510Z", "dateReserved": "2026-01-21T18:38:22.474Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T22:53:34.769Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "moonraker", "vendor": "Arksine", "versions": [{"status": "affected", "version": "< 0.10.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:arksine:moonraker:*:*:*:*:*:python:*:*", "matchCriteriaId": "DC3E79B0-4D30-48F6-87F5-19439216A6AE", "versionEndExcluding": "0.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the \"ldap\" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. This issue has been fixed in version 0.10.0."}, {"lang": "es", "value": "Moonraker es un servidor web Python que proporciona acceso API al firmware de impresi\u00f3n 3D Klipper. En las versiones 0.9.3 e inferiores, las instancias configuradas con el componente 'ldap' habilitado son vulnerables a t\u00e9cnicas de inyecci\u00f3n de filtros de b\u00fasqueda LDAP a trav\u00e9s del endpoint de inicio de sesi\u00f3n. El mensaje de respuesta de error 401 puede utilizarse para determinar si una b\u00fasqueda fue exitosa o no, permitiendo m\u00e9todos de fuerza bruta para descubrir entradas LDAP en el servidor, como IDs de usuario y atributos de usuario. Este problema ha sido solucionado en la versi\u00f3n 0.10.0."}], "id": "CVE-2026-24130", "lastModified": "2026-06-17T10:22:40.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24130", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T20:03:39.265186Z", "version": "2.0.3"}}]}, "published": "2026-01-22T23:15:58.477", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Arksine/moonraker/commit/74c5d8e44c4a4abbfbb06fb991e7ebb9ac947f42"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/Arksine/moonraker/security/advisories/GHSA-3jqf-v4mv-747g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-90"}, {"lang": "en", "value": "CWE-209"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:30:03.507625+00:00", "value": {"mitigation_remediation": ["Apply the official patch by upgrading to Moonraker 0.10.0 or later", "If LDAP functionality is unnecessary, disable the ldap component in the configuration to eliminate the vulnerable endpoint", "Implement network segmentation or firewall rules to restrict access to the login endpoint as a temporary countermeasure"], "summary": {"action": "Upgrade", "impact": "Information disclosure via LDAP search filter injection"}, "threat_synthesis": {"affected_systems": "Affected systems are Arksine Moonraker releases 0.9.3 and earlier when the ldap component is enabled. Users of these versions should review their configuration to confirm that LDAP integration is necessary.", "description_and_impact": "Moonraker, a Python web server that provides API access for Klipper 3D printing firmware, allows an attacker to inject malformed LDAP search filters through the login endpoint when the ldap component is enabled. The server responds with a 401 error that indicates whether a search was successful, enabling an attacker to systematically brute\u2011force discovery of LDAP entries such as user IDs and attributes. This does not grant code execution but can compromise the confidentiality of sensitive directory data.", "risk_and_exploitability": "The CVSS score of 2.7 reflects a low impact, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog, suggesting no publicly known exploits. The likely attack vector is any user who can reach the login endpoint over the network, allowing an attacker to send crafted requests that reveal LDAP entries. The lack of elevated privileges or execution rights means the threat is limited to enumeration and information disclosure. Current mitigations rely on disabling the vulnerable component or applying the official patch."}}}}, "created": "2026-01-23T10:27:22.321951+00:00", "updated": "2026-04-18T03:30:25.915849+00:00", "vendors": ["arksine", "arksine$PRODUCT$moonraker"]}