CVE-2026-41919: Apache OFBiz LDAP Injection Vulnerability

CVE-2026-41919 Overview

CVE-2026-41919 is an LDAP Injection vulnerability in Apache OFBiz, an open-source enterprise resource planning (ERP) system. The flaw stems from improper neutralization of special elements in Lightweight Directory Access Protocol (LDAP) queries, classified under [CWE-90]. Apache OFBiz versions before 24.09.06 are affected. An unauthenticated remote attacker can manipulate LDAP query syntax to access or modify directory data. The Apache Software Foundation released version 24.09.06 to address the issue.

Critical Impact

Unauthenticated attackers can inject malicious LDAP query syntax over the network to bypass authentication controls and expose or alter directory information stored in the OFBiz backend.

Affected Products

• Apache OFBiz versions prior to 24.09.06
• Deployments using LDAP authentication or directory integration
• Internet-facing OFBiz ERP instances

Discovery Timeline

• 2026-05-19 - CVE CVE-2026-41919 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-41919

Vulnerability Analysis

The vulnerability resides in code paths that construct LDAP queries from user-supplied input without proper sanitization. Apache OFBiz integrates with LDAP directories for authentication and user lookup operations. When attacker-controlled input flows directly into an LDAP filter string, special characters such as *, (, ), \, and NUL alter the structure of the query. This allows an attacker to break out of the intended filter context and append or modify search criteria.

The vulnerability is exploitable over the network without authentication or user interaction. Successful exploitation impacts both the confidentiality and integrity of directory data. Attackers can enumerate user accounts, extract attributes such as password hashes where exposed, or bypass authentication logic that relies on directory lookups.

Root Cause

The root cause is missing input neutralization before LDAP filter construction, mapped to [CWE-90]. Apache OFBiz did not escape LDAP metacharacters in user-supplied parameters used to build directory search filters. Secure LDAP integration requires explicit escaping per RFC 4515 or use of parameterized query APIs.

Attack Vector

An attacker sends crafted HTTP requests to OFBiz endpoints that forward input into LDAP queries. By injecting LDAP filter syntax such as *)(uid=* or *)(&(objectClass=*), the attacker rewrites the query logic. This can authenticate as arbitrary users, retrieve unauthorized directory entries, or perform Boolean-based blind extraction of sensitive attributes.

No public proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.073% (percentile 22.046) as of 2026-05-21.

The vulnerability manifests in LDAP filter construction code paths. See the Apache Thread Discussion and Openwall OSS Security Update for technical details.

Detection Methods for CVE-2026-41919

Indicators of Compromise

• HTTP requests to OFBiz login or user-lookup endpoints containing LDAP metacharacters such as *), (|, (&, or escaped parentheses
• Anomalous LDAP search queries originating from the OFBiz application service account
• Spikes in failed or unusually successful authentication events tied to directory lookups
• Unexpected LDAP bind operations with wildcard or boolean-modified filters

Detection Strategies

• Inspect web application logs for input parameters containing LDAP filter syntax in authentication and search fields
• Enable LDAP server audit logging and alert on filters containing wildcards or disjunctive operators originating from OFBiz
• Deploy web application firewall (WAF) rules that flag LDAP injection patterns in HTTP POST bodies and query strings
• Correlate OFBiz request logs with downstream LDAP query logs to identify injected filter structures

Monitoring Recommendations

• Continuously monitor outbound LDAP traffic from OFBiz hosts for query structure anomalies
• Track authentication success rates and alert on deviations following suspicious request patterns
• Audit directory service access logs for bulk attribute reads tied to a single source session
• Validate the running OFBiz version against 24.09.06 and flag any host below the patched baseline

How to Mitigate CVE-2026-41919

Immediate Actions Required

• Upgrade Apache OFBiz to version 24.09.06 or later without delay
• Inventory all OFBiz instances, including development and staging, and confirm patch status
• Restrict network access to OFBiz administrative and authentication endpoints to trusted sources
• Review LDAP service account permissions and reduce privileges to the minimum required

Patch Information

The Apache Software Foundation has released Apache OFBiz 24.09.06, which remediates CVE-2026-41919 by applying proper neutralization of LDAP special characters. Upgrade guidance is documented in the Apache Thread Discussion and the Openwall OSS Security Update. Apply the upgrade across all production and non-production OFBiz deployments.

Workarounds

• Place OFBiz behind a WAF with rules blocking LDAP injection metacharacters in user-controlled parameters
• Disable LDAP-backed authentication temporarily where feasible and use alternative authentication providers
• Apply network segmentation to isolate the LDAP directory from untrusted OFBiz request paths
• Enforce input validation at upstream reverse proxies to reject requests with LDAP filter syntax

# Configuration example: WAF rule pattern to block common LDAP injection payloads
SecRule ARGS "@rx (\*\)|\(\||\(\&|\)\(|\\00|\(objectClass=\*\))" \
  "id:1042026,phase:2,deny,status:403,msg:'LDAP Injection attempt - CVE-2026-41919'"