Apache Karaf’s LDAPCache and LDAPBackingEngine create search filters by textual substitution of placeholders %u, %dn, and %fqdn into administrator‑defined templates. The only sanitization performed was doubling backslashes, leaving unescaped LDAP filter meta‑characters such as *, (, ), and NUL. A username containing these characters can alter the structure of the resulting filter, turning an equality comparison into a wildcard or closing an expression prematurely. This can cause a user or role lookup to match unintended LDAP entries, potentially granting unauthorized access or roles.

The vulnerability exists in Apache Karaf. No specific version range is listed, so all builds that include the affected LDAPCache and LDAPBackingEngine components are potentially impacted. The lack of version detail means users should verify whether their installation includes the mentioned components and apply a fix when available.

The vulnerability has a CVSS score of 7.3, indicating a high severity. This high‑impact injection flaw (CWE‑90) could be leveraged to gain unintended LDAP access. The EPSS score is below 1%, suggesting low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The absence of publicly disclosed exploits indicates it is likely not yet abused in the wild, but the mechanism is straightforward and could be weaponized quickly once a patch is unavailable.