CVE-2026-40193: Maddy Mail Server Auth Bypass Vulnerability

CVE-2026-40193 Overview

CVE-2026-40193 is an LDAP Injection vulnerability affecting the Maddy mail server, a composable, all-in-one mail server written in Go. Versions prior to 0.9.3 contain a critical flaw in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without proper LDAP filter escaping. This is particularly notable because the ldap.EscapeFilter() function from the go-ldap/ldap/v3 library was available in the same import but was not utilized.

Critical Impact

Attackers with network access to SMTP submission or IMAP interfaces can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands, enabling identity spoofing, LDAP directory enumeration, and blind extraction of LDAP attribute values.

Affected Products

• Maddy Mail Server versions prior to 0.9.3
• Systems using the auth.ldap authentication module
• Environments exposing SMTP submission or IMAP interfaces to untrusted networks

Discovery Timeline

• April 16, 2026 - CVE-2026-40193 published to NVD
• April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40193

Vulnerability Analysis

This LDAP Injection vulnerability (CWE-90) exists in three distinct code paths within the Maddy mail server's LDAP authentication module. The vulnerability enables attackers to manipulate LDAP queries through unsanitized user input in authentication requests.

The affected code paths include the Lookup() filter function, the AuthPlain() DN template, and the AuthPlain() filter. In each case, user-controlled username values are directly interpolated into LDAP query strings without proper escaping. The irony of this vulnerability is that the proper mitigation—using ldap.EscapeFilter() from the go-ldap/ldap/v3 library—was already imported and available in the codebase but simply not utilized.

An attacker can exploit this vulnerability to achieve multiple malicious outcomes: identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration using wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths.

Root Cause

The root cause is improper input validation and missing LDAP-specific escaping when incorporating user-supplied usernames into LDAP search filters and Distinguished Name (DN) strings. The developers used the generic strings.ReplaceAll() function for string interpolation instead of the security-appropriate ldap.EscapeFilter() function. This oversight allows LDAP metacharacters such as *, (, ), \, and NUL bytes to be interpreted as query control characters rather than literal values.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can target the SMTP submission service (typically port 587) or IMAP service (typically port 143/993) and inject malicious LDAP filter expressions through the username parameter of AUTH PLAIN or LOGIN commands.

For example, an attacker could craft a username containing LDAP filter metacharacters to bypass authentication checks, enumerate valid usernames in the directory, or extract sensitive attribute values through boolean-based blind injection techniques. The presence of two distinct authentication failure paths also introduces timing side-channel opportunities for more sophisticated data extraction.

Technical details and the specific fix can be found in the GitHub Security Advisory and the patch commit.

Detection Methods for CVE-2026-40193

Indicators of Compromise

• Authentication log entries containing LDAP metacharacters (*, (, ), \, |, &) in usernames
• Unusual patterns in SMTP AUTH or IMAP LOGIN commands with malformed usernames
• LDAP query logs showing injected filter expressions or wildcard searches
• Multiple authentication attempts with incrementally modified usernames (indicative of blind injection enumeration)

Detection Strategies

• Monitor authentication logs for usernames containing special characters typical of LDAP injection attempts
• Implement anomaly detection for authentication timing patterns that may indicate exploitation of the dual failure path side-channel
• Deploy network intrusion detection rules to identify LDAP injection payloads in SMTP/IMAP traffic
• Audit LDAP server query logs for unexpected filter patterns or enumeration activity

Monitoring Recommendations

• Enable verbose logging on both the Maddy mail server and the backend LDAP directory
• Correlate failed authentication attempts across SMTP and IMAP services to identify coordinated injection campaigns
• Monitor for sudden increases in LDAP query volume that may indicate directory enumeration
• Implement alerting for authentication attempts using known LDAP injection test strings

How to Mitigate CVE-2026-40193

Immediate Actions Required

• Upgrade Maddy mail server to version 0.9.3 or later immediately
• Review authentication logs for signs of prior exploitation attempts
• Temporarily restrict network access to SMTP submission and IMAP services to trusted networks if immediate patching is not possible
• Audit user accounts for any unauthorized access that may have resulted from identity spoofing

Patch Information

The vulnerability has been fixed in Maddy version 0.9.3. The fix implements proper LDAP filter escaping using the ldap.EscapeFilter() function for all user-supplied inputs before interpolation into LDAP queries. The patch is available via the GitHub Release v0.9.3. The specific code changes can be reviewed in the commit update.

Workarounds

• Deploy a Web Application Firewall (WAF) or network filter to sanitize LDAP metacharacters in authentication requests
• Implement network-level access controls to limit SMTP submission and IMAP access to trusted IP ranges
• Consider temporarily disabling LDAP authentication and using an alternative authentication backend until patching is complete
• Monitor and rate-limit authentication attempts to slow potential blind injection enumeration

# Update Maddy mail server to patched version
# Using Go modules
go get github.com/foxcpp/maddy@v0.9.3
go mod tidy
go build

# Or download the release directly
wget https://github.com/foxcpp/maddy/releases/download/v0.9.3/maddy-0.9.3-linux-amd64.tar.zst