CVE-2026-49268 is a critical (CVSS 9.1) LDAP injection in the DefaultLdapRealm class of Apache Shiro. Usernames go into the LDAP distinguished name without escaping, which can bypass authentication or impersonate users. Upgrade to Shiro 2.2.1 or 3.0.0-alpha-2 or later.
What's affected
- Product: Apache Shiro, the Java security framework, when you use
DefaultLdapRealm. - Affected: all versions through 2.2.0, and 3.0.0-alpha-1.
- Fixed: 2.2.1 or 3.0.0-alpha-2 or later, per the CVE record.
- Weakness: CWE-90, LDAP injection.
- CVSS 9.1 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. - Published 17 June 2026. Not marked as exploited in CISA KEV.
If your application uses a different realm, such as a JDBC realm or a custom one, this CVE is not about it. Check anyway whether any code builds LDAP names by string concatenation.
How to check if you're exposed
Find Shiro in your dependency tree.
# Maven
mvn dependency:tree -Dincludes=org.apache.shiro
# Gradle
gradle dependencies --configuration runtimeClasspath | grep -i shiro
Then search your code and configuration for the class name.
grep -R "DefaultLdapRealm" --include=*.java --include=*.ini --include=*.xml --include=*.properties .
If the class never appears, you are unlikely to be using the vulnerable path. Look in shiro.ini and Spring configuration as well as Java source.
What to do now
- Upgrade Shiro to 2.2.1, or to 3.0.0-alpha-2 or later if you are on the 3.0 line.
- Rebuild and redeploy every service that bundles Shiro. A library fix does nothing for a stale jar.
- Review LDAP authentication logs for logins with unusual characters in the username field.
- If you use a custom LDAP realm, check that user input is escaped for distinguished names before it is placed in a template.
- Consider whether LDAP binds should be rate limited and monitored.
Why it matters
An LDAP distinguished name has its own syntax, with special characters defined by RFC 2253. When a username is dropped into a DN template as plain text, a person can supply characters that change the structure of the name. The record says that can bypass authentication or let someone act as another user. The class is CWE-90.
It is the same shape as SQL injection: data and structure mixed in one string. The fix is to escape on the way in, which is what the patched releases do.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.
Quick check
Does upgrading Shiro fix my custom LDAP code?
No. The fix covers DefaultLdapRealm. If you wrote your own realm, review how it builds names.
Sources
- Apache announcement thread (named in the CVE record; its page did not render for me, so details come from the record)
- oss-security post
- Safeguard Gold entry
Last reviewed: 19 October 2026.
