Description
An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input.
Published: 2026-05-21
Score: 4.2 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Netatalk software versions 2.1.0 through 4.4.2 contain an LDAP filter injection flaw that permits an authenticated attacker to craft LDAP filter strings to manipulate queries, retrieve limited information, or modify LDAP entries. The weakness is identified as CWE‑90.

Affected Systems

The affected product is Netatalk, released by the Netatalk project, with vulnerable releases ranging from version 2.1.0 to 4.4.2.

Risk and Exploitability

The CVSS score of 4.2 indicates moderate impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Since Netatalk exposes LDAP filtering over the network, the likely attack vector is remote over the service interface by an authenticated user; this is inferred from the requirement for authentication described in the product’s vulnerable behavior.

Generated by OpenCVE AI on May 21, 2026 at 11:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Netatalk to a newer, non‑vulnerable release (version newer than 4.4.2 if available).
  • Restrict LDAP service access to trusted networks or users only to reduce exposure.
  • Monitor LDAP query logs for anomalous filter strings and consider rate‑limiting or blocking suspicious traffic.

Generated by OpenCVE AI on May 21, 2026 at 11:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 21 May 2026 09:00:00 +0000

Type Values Removed Values Added
Description In Netatalk 2.1.0 through 4.4.2, ldap filter injection. Fixed in 4.5.0. An LDAP injection vulnerability in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to manipulate LDAP queries and obtain limited information or modify LDAP entries via crafted filter input.

Thu, 21 May 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Netatalk
Netatalk netatalk
Vendors & Products Netatalk
Netatalk netatalk

Thu, 21 May 2026 07:45:00 +0000

Type Values Removed Values Added
Description In Netatalk 2.1.0 through 4.4.2, ldap filter injection. Fixed in 4.5.0.
Title LDAP filter injection
Weaknesses CWE-90
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Netatalk Netatalk
cve-icon MITRE

Status: PUBLISHED

Assigner: securin

Published:

Updated: 2026-05-21T07:52:36.175Z

Reserved: 2026-05-05T07:25:12.313Z

Link: CVE-2026-44063

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-21T08:16:21.907

Modified: 2026-05-21T09:16:28.547

Link: CVE-2026-44063

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-21T11:45:09Z

Weaknesses