CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Record
CVE-2026-44930- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-90
- Updated
- 2026-11-02
CVE List
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Record
CVE-2026-44930- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-90, CWE-90
- Updated
- 2026-11-02
EUVDEUVD-2026-31433
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Record
EUVD-2026-31433- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-pg32-686q-qh6x
Apache CXF has an LDAP injection vulnerability
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Record
GHSA-pg32-686q-qh6x- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-90
- Updated
- 2026-11-02
OSV
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Record
CVE-2026-44930- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-90
- Updated
- 2026-11-07
OSVGHSA-pg32-686q-qh6x
Apache CXF has an LDAP injection vulnerability
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue.
- Record
GHSA-pg32-686q-qh6x- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-90
- Updated
- 2026-11-02
OSVCLSA-2026-1785974335 No score
TuxCare security update for 2 packages (2 CVEs)
TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 3.5.9-tuxcare.6.
- Record
CLSA-2026-1785974335- Updated
- 2026-11-02
OSVCLSA-2026-1786415148 No score
TuxCare security update for 2 packages (2 CVEs)
TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 3.5.11-tuxcare.8.
- Record
CLSA-2026-1786415148- Updated
- 2026-11-02
OSVCLSA-2026-1794008495 No score
TuxCare security update for 8 packages (12 CVEs)
TuxCare rebuilt 8 packages to address 12 CVEs. Fixed in 3.4.5-tuxcare.2.
- Record
CLSA-2026-1794008495- Updated
- 2026-11-07
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapMaven |
4.2.0 to 4.2.0 | 4.2.1 |
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapMaven |
4.1.0 up to 4.1.6 | 4.1.6 |
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapMaven |
before 3.6.11 | 3.6.11 |
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapTuxCare:Maven From an advisory covering 2 CVEs |
3.5.9 up to 3.5.9-tuxcare.6, plus listed versions 3.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.43.5.9-tuxcare.53.5.9.tuxcare.1 |
3.5.9-tuxcare.6 |
org.apache.cxf:cxf-rt-transports-jmsTuxCare:Maven From an advisory covering 2 CVEs |
3.5.9 up to 3.5.9-tuxcare.6, plus listed versions 3.5.9-tuxcare.23.5.9-tuxcare.33.5.9-tuxcare.43.5.9-tuxcare.53.5.9.tuxcare.1 |
3.5.9-tuxcare.6 |
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapTuxCare:Maven From an advisory covering 2 CVEs |
3.5.11 up to 3.5.11-tuxcare.8, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.7 |
3.5.11-tuxcare.8 |
org.apache.cxf:cxf-rt-transports-jmsTuxCare:Maven From an advisory covering 2 CVEs |
3.5.11 up to 3.5.11-tuxcare.8, plus listed versions 3.5.11-tuxcare.13.5.11-tuxcare.23.5.11-tuxcare.33.5.11-tuxcare.43.5.11-tuxcare.53.5.11-tuxcare.63.5.11-tuxcare.7 |
3.5.11-tuxcare.8 |
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-integration-jcaTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-rt-frontend-jaxrsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-rs-security-jose-jaxrsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-rs-security-oauth2TuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-transports-jmsTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf:cxf-rt-wsdlTuxCare:Maven From an advisory covering 12 CVEs |
3.4.5 up to 3.4.5-tuxcare.2, plus listed versions 3.4.5-tuxcare.1 |
3.4.5-tuxcare.2 |
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapMaven |
4.2.0 up to 4.2.1 | 4.2.1 |
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapMaven |
4.1.0 up to 4.1.6, plus listed versions 4.1.14.1.24.1.34.1.44.1.5 |
4.1.6 |
org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldapMaven |
before 3.6.11, plus listed versions 3.0.03.0.13.0.103.0.113.0.12 Show 45 moreShow less3.0.133.0.143.0.153.0.163.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.103.1.113.1.123.1.133.1.143.1.153.1.163.1.173.1.183.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.13.2.103.2.113.2.123.2.133.2.143.2.23.2.33.2.43.2.53.2.63.2.73.2.8 |
3.6.11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, facts | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-44930 is a critical vulnerability (CVSS 9.8) in Apache Cxf, published May 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap 4.2.1.
References
Left out here: 49 versions. The JSON record has them.