CVE-2026-94052: Apache MINA SSHD Auth Bypass Vulnerability

CVE-2026-94052 Overview

CVE-2026-94052 is an authentication bypass vulnerability in the LdapPasswordAuthenticator class within the sshd-ldap component of Apache MINA SSHD. The flaw stems from a missing check that allows attackers to bypass password authentication against the configured LDAP directory. Affected versions include Apache MINA SSHD 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5. Only SSH servers that explicitly configure LdapPasswordAuthenticator are impacted. The default password authentication mechanisms in sshd-core are not affected. The Apache MINA project fixed the issue in versions 2.20.0 and 3.0.0-M6.

Critical Impact
Remote unauthenticated attackers can bypass LDAP-backed password authentication and gain SSH access to affected servers.

Affected Products

Apache MINA SSHD 1.2.0 through 2.19.0 (with sshd-ldap component)
Apache MINA SSHD 3.0.0-M1 through 3.0.0-M5 (with sshd-ldap component)
SSH server deployments configured to use LdapPasswordAuthenticator

Discovery Timeline

2026-09-30 - CVE-2026-94052 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-94052

Vulnerability Analysis

Apache MINA SSHD is a Java library that provides client-side and server-side SSH functionality. The optional sshd-ldap component integrates password and public key authentication with an LDAP directory. Server operators use LdapPasswordAuthenticator to delegate password verification to an LDAP server.

The vulnerability arises from a missing validation step in the LdapPasswordAuthenticator implementation. The authenticator fails to properly verify the outcome of the LDAP bind operation before returning an authentication decision. This maps to [CWE-304]: Missing Critical Step in Authentication.

An attacker who reaches the SSH service can submit crafted credentials and receive a successful authentication result without the LDAP directory validating the password. The impact extends to any account managed through the LDAP-backed authenticator, including privileged accounts.

Root Cause

The root cause is a logic flaw in LdapPasswordAuthenticator where the code path returning the authentication result does not enforce the check that confirms the LDAP bind actually validated the supplied password. The authenticator treats certain response conditions as successful when they should be rejected. The fix in 2.20.0 and 3.0.0-M6 restores the missing verification.

Attack Vector

Exploitation requires network access to the SSH port of a server that uses Apache MINA SSHD with sshd-ldap and an LdapPasswordAuthenticator. No prior authentication, credentials, or user interaction are required. An attacker initiates an SSH session, supplies a username of interest, and provides input that triggers the authenticator's flawed success path. Successful exploitation yields authenticated SSH access with the privileges of the targeted account.

No verified public proof-of-concept code is currently available. Refer to the Apache Thread Discussion and the OpenWall OSS-Security Update for the vendor disclosure details.

Detection Methods for CVE-2026-94052

Indicators of Compromise

Successful SSH authentications for LDAP-backed accounts without corresponding LDAP bind success entries in directory server logs.
Unexpected SSH sessions established from unfamiliar source IP addresses to hosts running Apache MINA SSHD with sshd-ldap configured.
Authentication events in application logs where LdapPasswordAuthenticator returned success but the LDAP server recorded no matching authentication attempt.

Detection Strategies

Inventory Java applications and appliances that embed Apache MINA SSHD and identify those loading the sshd-ldap module and configuring LdapPasswordAuthenticator.
Correlate SSH authentication success events with LDAP directory bind logs to identify mismatches indicating bypassed authentication.
Monitor SSH login patterns for accounts that authenticate outside their normal source networks or working hours.

Monitoring Recommendations

Forward SSH daemon logs and LDAP directory logs to a centralized analytics platform for cross-source correlation.
Alert on authentication anomalies such as burst logins across multiple accounts from a single source IP.
Track the classpath and version metadata of deployed Java applications to detect vulnerable Apache MINA SSHD releases.

How to Mitigate CVE-2026-94052

Immediate Actions Required

Upgrade Apache MINA SSHD to version 2.20.0 or 3.0.0-M6 in all applications that ship the sshd-ldap component.
Audit deployed applications and appliances for embedded Apache MINA SSHD libraries and confirm the effective version at runtime.
Rotate credentials for any accounts served by LdapPasswordAuthenticator if unauthorized access cannot be ruled out.

Patch Information

Apache MINA SSHD versions 2.20.0 and 3.0.0-M6 contain the fix for the missing check in LdapPasswordAuthenticator. Update the Maven or Gradle dependency declaration for org.apache.sshd:sshd-ldap to a fixed version and rebuild affected applications. Redeploy all instances after verifying the resolved dependency tree.

Workarounds

Remove the sshd-ldap component from the classpath if LDAP-backed SSH authentication is not required.
Replace LdapPasswordAuthenticator with the built-in password authentication mechanisms in sshd-core, which are not affected by this vulnerability.
Restrict network access to the SSH service using firewall rules or bastion hosts until the patched version is deployed.

bash

# Maven dependency update example
# <dependency>
#   <groupId>org.apache.sshd</groupId>
#   <artifactId>sshd-ldap</artifactId>
#   <version>2.20.0</version>
# </dependency>

mvn versions:set-property -Dproperty=sshd.version -DnewVersion=2.20.0
mvn dependency:tree | grep sshd