{"id":"CVE-2026-40193","sourceIdentifier":"security-advisories@github.com","published":"2026-04-16T00:16:28.163","lastModified":"2026-10-26T21:10:00.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the go-ldap/ldap/v3 library's ldap.EscapeFilter() function being available in the same import. This affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths. This issue has been fixed in version 0.9.3."},{"lang":"es","value":"maddy es un servidor de correo componible, todo en uno. Las versiones anteriores a la 0.9.3 contienen una vulnerabilidad de inyección LDAP en el módulo auth.ldap donde los nombres de usuario proporcionados por el usuario se interpolan en filtros de búsqueda LDAP y cadenas DN a través de strings.ReplaceAll() sin ningún escape de filtro LDAP, a pesar de que la función ldap.EscapeFilter() de la biblioteca go-ldap/ldap/v3 está disponible en la misma importación. Esto afecta a tres rutas de código: el filtro Lookup(), la plantilla DN de AuthPlain() y el filtro AuthPlain(). Un atacante con acceso de red a la interfaz de envío SMTP o IMAP puede inyectar expresiones de filtro LDAP arbitrarias a través del campo de nombre de usuario en los comandos AUTH PLAIN o LOGIN. Esto permite la suplantación de identidad manipulando los resultados del filtro para autenticarse como otro usuario, la enumeración de directorios LDAP a través de filtros comodín y la extracción ciega de valores de atributos LDAP utilizando las respuestas de autenticación como un oráculo booleano o a través de canales laterales de tiempo entre las dos rutas de fallo distintas. Este problema ha sido solucionado en la versión 0.9.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"foxcpp","product":"maddy","versions":[{"version":"< 0.9.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-16T14:23:43.299676Z","id":"CVE-2026-40193","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-90"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:maddy_project:maddy:*:*:*:*:*:*:*:*","versionEndExcluding":"0.9.3","matchCriteriaId":"6F8403E8-747F-445C-9600-F61FBE0B2686"}]}]}],"references":[{"url":"https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/foxcpp/maddy/releases/tag/v0.9.3","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}