CVE-2026-10549: Yandex Database Auth Bypass Vulnerability

CVE-2026-10549 Overview

CVE-2026-10549 is an LDAP filter injection vulnerability in Yandex Database (YDB) versions prior to 25.3.1.25. The flaw allows a remote authenticated attacker holding valid Lightweight Directory Access Protocol (LDAP) credentials to bypass group membership checks. Successful exploitation grants unauthorized access to the database beyond the attacker's intended authorization level. The issue is tracked under CWE-280: Improper Handling of Insufficient Permissions or Privileges.

Critical Impact
An authenticated LDAP user can manipulate filter expressions to bypass group-based access controls and reach database resources outside their assigned privileges.

Affected Products

Yandex Database (YDB) versions prior to 25.3.1.25
YDB deployments configured with LDAP authentication and group-based authorization
Any application stack relying on YDB LDAP group membership for access control

Discovery Timeline

2026-06-02 - CVE-2026-10549 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10549

Vulnerability Analysis

The vulnerability resides in how YDB constructs LDAP search filters during group membership validation. When YDB queries the directory server to determine whether an authenticated user belongs to an authorized group, user-controlled attributes are concatenated into the filter expression without proper escaping of LDAP metacharacters. An attacker who controls portions of the filter input can inject additional filter clauses that alter the boolean logic of the query.

This falls under the LDAP Injection class of input validation flaws. The CWE-280 classification highlights that YDB does not correctly handle situations where the directory response does not match the privileges the user should actually possess. Because the membership check is the gating control for database authorization, bypassing it directly translates to unauthorized data access.

The attack requires valid LDAP credentials, which limits exposure to insider threats, compromised accounts, or environments where low-privilege LDAP accounts are broadly provisioned. EPSS data lists the probability of exploitation in the wild at 0.052%.

Root Cause

The root cause is the construction of LDAP search filters using unsanitized user input. LDAP filter syntax uses characters such as *, (, ), \, and NUL as control metacharacters. Failing to escape these characters per RFC 4515 allows an attacker to inject sub-filters that evaluate to true regardless of the user's actual group membership.

Attack Vector

The vulnerability is exploited over the network by an authenticated user. The attacker authenticates to YDB using legitimate LDAP credentials, then submits crafted input that influences the group lookup filter. Injected metacharacters cause the directory query to return results suggesting membership in privileged groups. YDB then grants database access based on this falsified membership response. No user interaction or elevated privileges are required beyond a standard LDAP account.

For implementation specifics, see the YDB Security Changelog.

Detection Methods for CVE-2026-10549

Indicators of Compromise

LDAP search filters in directory server logs containing unescaped metacharacters such as *)(uid=, *)(|(cn=, or similar boolean-bypass patterns originating from YDB connector accounts.
Successful YDB authentication events for users who subsequently access tables or schemas outside their nominal group entitlements.
Unexpected spikes in LDAP bind or search activity from YDB service hosts targeting privileged group containers.

Detection Strategies

Audit directory server query logs for LDAP filter strings containing parenthesis or wildcard sequences in attribute values that should only contain usernames.
Correlate YDB authorization decisions with the actual group memberships recorded in the directory to flag access grants that lack a matching membership entry.
Inventory all YDB instances and compare their version strings against 25.3.1.25 to identify exposed deployments.

Monitoring Recommendations

Enable verbose LDAP search logging on directory controllers and forward events to a central analytics platform for filter-pattern analysis.
Alert on YDB role escalations or first-time access to sensitive schemas by accounts that recently authenticated via LDAP.
Track failed and successful LDAP binds tied to YDB service accounts to baseline normal behavior and surface deviations.

How to Mitigate CVE-2026-10549

Immediate Actions Required

Upgrade all YDB clusters to version 25.3.1.25 or later, which contains the fix for the LDAP filter injection flaw.
Rotate credentials of LDAP service accounts used by YDB to invalidate any sessions that may have been abused.
Review group memberships and recent authorization events for anomalies indicating prior exploitation.

Patch Information

The vendor addressed CVE-2026-10549 in YDB 25.3.1.25. Refer to the YDB Security Changelog for the official release notes and patch details.

Workarounds

Restrict YDB LDAP authentication to a curated set of accounts with strong password policy and multi-factor authentication enforced at the directory layer.
Constrain the LDAP search base used by YDB to the minimum subtree required, reducing the scope of groups that an injected filter can evaluate against.
If LDAP authentication is not required, disable the LDAP authentication provider in YDB configuration until the patch is applied.

bash

# Verify the running YDB version before and after patching
ydb --version

# Expected output after remediation:
# YDB CLI 25.3.1.25 (or later)