CVE-2026-40193

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40193", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-09T20:59:17.620Z", "datePublished": "2026-04-15T23:15:25.011Z", "dateUpdated": "2026-04-16T14:23:52.438Z"}, "containers": {"cna": {"title": "Maddy Mail Server: LDAP Filter Injection via Unsanitized Username", "problemTypes": [{"descriptions": [{"cweId": "CWE-90", "lang": "en", "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc"}, {"name": "https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba", "tags": ["x_refsource_MISC"], "url": "https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba"}, {"name": "https://github.com/foxcpp/maddy/releases/tag/v0.9.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/foxcpp/maddy/releases/tag/v0.9.3"}], "affected": [{"vendor": "foxcpp", "product": "maddy", "versions": [{"version": "< 0.9.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-15T23:15:25.011Z"}, "descriptions": [{"lang": "en", "value": "maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the go-ldap/ldap/v3 library's ldap.EscapeFilter() function being available in the same import. This affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths. This issue has been fixed in version 0.9.3."}], "source": {"advisory": "GHSA-5835-4gvc-32pc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T14:23:43.299676Z", "id": "CVE-2026-40193", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T14:23:52.438Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40193", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T14:23:43.299676Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T14:23:48.474Z"}}], "cna": {"title": "Maddy Mail Server: LDAP Filter Injection via Unsanitized Username", "source": {"advisory": "GHSA-5835-4gvc-32pc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "foxcpp", "product": "maddy", "versions": [{"status": "affected", "version": "< 0.9.3"}]}], "references": [{"url": "https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc", "name": "https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba", "name": "https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/foxcpp/maddy/releases/tag/v0.9.3", "name": "https://github.com/foxcpp/maddy/releases/tag/v0.9.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the go-ldap/ldap/v3 library's ldap.EscapeFilter() function being available in the same import. This affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths. This issue has been fixed in version 0.9.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-90", "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-15T23:15:25.011Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40193", "state": "PUBLISHED", "dateUpdated": "2026-04-16T14:23:52.438Z", "dateReserved": "2026-04-09T20:59:17.620Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-15T23:15:25.011Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "maddy", "vendor": "foxcpp", "versions": [{"status": "affected", "version": "< 0.9.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:maddy_project:maddy:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F8403E8-747F-445C-9600-F61FBE0B2686", "versionEndExcluding": "0.9.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the go-ldap/ldap/v3 library's ldap.EscapeFilter() function being available in the same import. This affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths. This issue has been fixed in version 0.9.3."}, {"lang": "es", "value": "maddy es un servidor de correo componible, todo en uno. Las versiones anteriores a la 0.9.3 contienen una vulnerabilidad de inyecci\u00f3n LDAP en el m\u00f3dulo auth.ldap donde los nombres de usuario proporcionados por el usuario se interpolan en filtros de b\u00fasqueda LDAP y cadenas DN a trav\u00e9s de strings.ReplaceAll() sin ning\u00fan escape de filtro LDAP, a pesar de que la funci\u00f3n ldap.EscapeFilter() de la biblioteca go-ldap/ldap/v3 est\u00e1 disponible en la misma importaci\u00f3n. Esto afecta a tres rutas de c\u00f3digo: el filtro Lookup(), la plantilla DN de AuthPlain() y el filtro AuthPlain(). Un atacante con acceso de red a la interfaz de env\u00edo SMTP o IMAP puede inyectar expresiones de filtro LDAP arbitrarias a trav\u00e9s del campo de nombre de usuario en los comandos AUTH PLAIN o LOGIN. Esto permite la suplantaci\u00f3n de identidad manipulando los resultados del filtro para autenticarse como otro usuario, la enumeraci\u00f3n de directorios LDAP a trav\u00e9s de filtros comod\u00edn y la extracci\u00f3n ciega de valores de atributos LDAP utilizando las respuestas de autenticaci\u00f3n como un or\u00e1culo booleano o a trav\u00e9s de canales laterales de tiempo entre las dos rutas de fallo distintas. Este problema ha sido solucionado en la versi\u00f3n 0.9.3."}], "id": "CVE-2026-40193", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40193", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T14:23:43.299676Z", "version": "2.0.3"}}]}, "published": "2026-04-16T00:16:28.163", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/foxcpp/maddy/releases/tag/v0.9.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-90"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.9.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "maddy", "source": "cna", "vendor": "foxcpp"}, "product": "maddy", "vendor": "foxcpp"}], "analysis": {"en": {"generated_at": "2026-04-16T09:04:11.100465+00:00", "value": {"mitigation_remediation": ["Update maddy to version 0.9.3 or later to eliminate unsanitized LDAP filter construction.", "If an upgrade cannot be performed immediately, disable LDAP authentication for untrusted clients or block AUTH PLAIN/LOGIN traffic until the patch is applied.", "Continuously monitor authentication logs for anomalous LDAP filter patterns and confirm that no unauthorized authentication attempts succeed."], "summary": {"action": "Immediate Patch", "impact": "Identity Spoofing"}, "threat_synthesis": {"affected_systems": "foxcpp\u2019s maddy mail server; any deployment using maddy before the 0.9.3 release is affected. The issue spans three code paths: the Lookup filter, the AuthPlain DN template, and the AuthPlain filter.", "description_and_impact": "In maddy mail server versions prior to 0.9.3, a user supplied username in LDAP authentication commands is concatenated directly into LDAP search filters and DN strings without proper escaping. This LDAP filter injection allows an attacker to embed arbitrary filter expressions, potentially tricking the directory service into returning records belonging to other users. The vulnerability can also be leveraged to enumerate directory entries or extract attribute values via side\u2011channel techniques such as oracle responses or timing differences.", "risk_and_exploitability": "The flaw carries a CVSS score of 8.2, indicating high severity. Exploitation requires network access to the SMTP submission or IMAP interface, a common setup for email servers. While an EPSS score is not published, the absence of a KEV listing suggests it is not a known widely exploited vulnerability yet, but the high CVSS and the potential for identity spoofing and directory enumeration make it a high\u2011priority risk."}}}}, "created": "2026-04-16T00:30:18.768687+00:00", "updated": "2026-04-16T09:15:30.976766+00:00", "vendors": ["foxcpp", "foxcpp$PRODUCT$maddy"]}