Moonraker, a Python web server that provides API access for Klipper 3D printing firmware, allows an attacker to inject malformed LDAP search filters through the login endpoint when the ldap component is enabled. The server responds with a 401 error that indicates whether a search was successful, enabling an attacker to systematically brute‑force discovery of LDAP entries such as user IDs and attributes. This does not grant code execution but can compromise the confidentiality of sensitive directory data.

Affected systems are Arksine Moonraker releases 0.9.3 and earlier when the ldap component is enabled. Users of these versions should review their configuration to confirm that LDAP integration is necessary.

The CVSS score of 2.7 reflects a low impact, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits. The likely attack vector is any user who can reach the login endpoint over the network, allowing an attacker to send crafted requests that reveal LDAP entries. The lack of elevated privileges or execution rights means the threat is limited to enumeration and information disclosure. Current mitigations rely on disabling the vulnerable component or applying the official patch.