CVE-2026-44930 is a critical LDAP injection (CVSS 9.8) in the LDAP certificate repository of the XKMS server in Apache CXF. An attacker may retrieve arbitrary certificates from the repository. Upgrade to 4.2.1, 4.1.6 or 3.6.11, depending on which CXF line you run today.
What's affected
From the Apache announcement, the affected component is org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap:
- 4.2.0, fixed in 4.2.1
- 4.0.0 up to before 4.1.6, fixed in 4.1.6
- Before 3.6.11, fixed in 3.6.11
Only deployments that run the XKMS service with the LDAP certificate repository are in scope. Plain CXF web service or REST use, with no XKMS LDAP module, does not include the vulnerable component.
How to check if you're exposed
Check whether the module is in your build:
mvn dependency:tree -Dincludes=org.apache.cxf.services.xkms
For Gradle projects, use the dependencies task and search for cxf-services-xkms. Then check deployed WARs and fat JARs for the module name, since runtime packaging can differ from the build file. If it is present, check its version against the list above.
What to do now
- Upgrade the XKMS LDAP repository module to 4.2.1, 4.1.6 or 3.6.11, matching your CXF line.
- Rebuild and redeploy applications that bundle the module.
- Limit network access to the XKMS endpoint to the clients that need it.
- Review LDAP query logs for unusual filters sent by the service.
Why it matters
The class is CWE-90 (LDAP injection). The repository builds an LDAP search filter from request data. If special characters in that data are not escaped, the caller can change the shape of the search and ask for entries the service never meant to return.
Here the data at stake is the certificate repository, which the announcement says an attacker may be able to read in full. Certificates are public by design, but a store can also reveal internal naming, device and user identities that you did not want to publish.
The record does not mark this CVE as KEV. The standard defense is to escape or reject special characters in filter values, which the fixed releases are expected to do. Check the announcement for details.
Quick check
Does this affect all Apache CXF users?
No. The affected component is the XKMS LDAP repository module. Check whether you use it.
Sources
Last reviewed: 19 October 2026.
