CVE-2026-11748: CentralDogma Auth Bypass Vulnerability

CVE-2026-11748 Overview

CVE-2026-11748 is an LDAP injection vulnerability in centraldogma-server-auth-shiro versions prior to 0.84.0. The SearchFirstActiveDirectoryRealm component embeds the login username directly into a Lightweight Directory Access Protocol (LDAP) search filter without neutralizing filter metacharacters. An unauthenticated remote attacker can submit crafted usernames to manipulate the filter logic, cause authentication confusion, and enumerate the underlying directory structure. The flaw is classified as [CWE-90] (Improper Neutralization of Special Elements used in an LDAP Query).

Critical Impact
Unauthenticated attackers can manipulate LDAP search filters in Central Dogma to confuse authentication outcomes and enumerate Active Directory contents over the network.

Affected Products

Line Central Dogma centraldogma-server-auth-shiro versions prior to 0.84.0
Deployments using the SearchFirstActiveDirectoryRealm Shiro realm for authentication
Central Dogma servers integrated with Active Directory backends

Discovery Timeline

2026-06-22 - CVE-2026-11748 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-11748

Vulnerability Analysis

The vulnerability resides in the SearchFirstActiveDirectoryRealm class within centraldogma-server-auth-shiro. During authentication, the realm constructs an LDAP search filter by concatenating the user-supplied login username into a filter template. The code does not escape LDAP filter metacharacters such as *, (, ), \, and the NUL byte before composing the query.

Because the filter is sent to the directory service as-is, an attacker controls part of the filter syntax. This allows the attacker to alter boolean logic, broaden search scope, or coerce the directory to return objects unrelated to the supplied identifier. The realm then evaluates authentication results against entries the attacker effectively chose, producing inconsistent authentication decisions.

LDAP injection in authentication realms is a recognized class of weakness under [CWE-90]. Even without a successful login, the differential responses returned by the directory enable directory enumeration of users, groups, and organizational units.

Root Cause

The root cause is the absence of LDAP-specific input neutralization in the SearchFirstActiveDirectoryRealm filter construction path. User input intended as a search term is treated as filter syntax. RFC 4515 requires escaping of reserved characters such as (, ), *, \, and NUL before insertion into a filter expression, and the affected versions omit this step.

Attack Vector

An unauthenticated attacker submits a login request to the Central Dogma authentication endpoint with a username containing LDAP metacharacters such as *)(uid=* or wildcard sequences. The malicious payload modifies the search filter executed against Active Directory. By varying payloads and observing authentication or error responses, the attacker can confuse authentication decisions and map directory contents. No prior credentials, user interaction, or local access are required.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-98q5-5qh2-7w75 for additional technical context.

Detection Methods for CVE-2026-11748

Indicators of Compromise

Authentication requests to Central Dogma containing LDAP metacharacters such as *, (, ), or \ inside the username field.
Repeated failed or anomalously successful authentication attempts originating from a single source within short time windows.
LDAP server logs showing search filters with wildcard expansions or unexpected boolean combinations originating from the Central Dogma service account.

Detection Strategies

Inspect Central Dogma access logs for login submissions whose username field contains characters outside the expected identifier character set.
Correlate Central Dogma authentication events with directory server query logs to detect filters that deviate from the expected (sAMAccountName=value) pattern.
Alert on bursts of authentication attempts producing varying directory result counts, which indicate enumeration behavior.

Monitoring Recommendations

Forward Central Dogma and Active Directory logs to a centralized analytics platform for correlation and retention.
Track the version of centraldogma-server-auth-shiro deployed across all Central Dogma instances and flag any below 0.84.0.
Monitor outbound LDAP query volume from Central Dogma hosts for sustained spikes consistent with directory enumeration.

How to Mitigate CVE-2026-11748

Immediate Actions Required

Upgrade centraldogma-server-auth-shiro to version 0.84.0 or later on all Central Dogma deployments.
Restrict network access to the Central Dogma authentication endpoint to trusted networks until patching is complete.
Review historical authentication and LDAP query logs for evidence of exploitation attempts.

Patch Information

The maintainers fixed the issue in centraldogma-server-auth-shiro version 0.84.0 by neutralizing LDAP filter metacharacters in usernames before inclusion in the search filter. Patch details are available in the GitHub Security Advisory GHSA-98q5-5qh2-7w75.

Workarounds

If upgrading immediately is not feasible, configure an alternative Shiro realm that does not use unsanitized LDAP filter construction.
Place a reverse proxy or web application firewall in front of Central Dogma to reject login payloads containing LDAP metacharacters.
Constrain the directory service account used by Central Dogma to the minimum search scope and attribute set required for authentication.

bash

# Configuration example: pin centraldogma-server-auth-shiro to a fixed version
# build.gradle dependency declaration
dependencies {
    implementation 'com.linecorp.centraldogma:centraldogma-server-auth-shiro:0.84.0'
}