CVE-2026-74241

Katalog CVE

CVSS 6.5 · Medium EPSS 0,31%

Kerentanan Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') pada redhat openshift update service, redhat quay. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling user-existence oracle attacks at the referral Directory Name (DN). This could also potentially influence which DN is used for password binding in multi-domain Active Directory environments.

Rincian

Terbit di NVD

14 Agustus 2026

Terakhir diubah

20 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-74241 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2516141 issue tracking · advisory vendor