CVE-2026-11748 json
Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion
published 2026-06-22 4 mo ago modified 2026-10-25 14 d ago also GHSA-98q5-5qh2-7w75 , EUVD-2026-38208
- cvss
- 6.9
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing LDAP filter metacharacters, allowing an unauthenticated attacker to manipulate the filter to cause authentication confusion and enumerate the directory structure.
Patch / fix
- maven com.linecorp.centraldogma:centraldogma-server-auth-shiro 0.84.0
- LY Corporation Central Dogma 0.84.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/line/centraldogma/security/advisories/GHSA-98q5-5qh2-7w75 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.linecorp.centraldogma:centraldogma-server-auth-shiro | <0.84.0 |
0.84.0 |
Affected products
- LY Corporation Central Dogma
Classification
- Weakness
-
- CWE-90 Improper Neutralization of Special Elements used in an LDAP Query
References
Sources
- CVE List CVE-2026-11748
- GitHub Advisory GHSA-98q5-5qh2-7w75
- NVD CVE-2026-11748
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.