anonhaven

CVE-2026-94052

CRITICAL CVSS 3.1: 9.1 EPSS 0.38%
Updated Sep 30, 2026
Apache
Parameter Value
CVSS 9.1 (CRITICAL)
Affected Versions 1.2.0 — 2.19.0
Type CWE-304
Vendor Apache
Public PoC No

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component.

SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is _not_ affected by this vulnerability, which concerns only LdapPasswordAuthenticator. Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-304

Vulnerable Products

apache software foundation:apache mina sshd

References 2

https://lists.apache.org/thread.html/qch5kdwwms13y6bylb7c6qqzq718wn24
security@apache.org
http://www.openwall.com/lists/oss-security/2026/09/29/38
af854a3a-2127-422b-91ae-364da2661108
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-59265

Apache

None

CVE-2026-102795

Apache

7.0

CVE-2026-96289

Apache

8.2

CVE-2026-96287

Apache

8.2

CVE-2026-96286

Apache

8.2