{"id":"CVE-2026-111262","kind":"vulnerability","aliases":["CVE-2026-111262"],"related":[],"title":"Jakarta Security LDAP store: caller name lets attackers alter directory queries","description":"The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influence which directory entry the login is validated against. Only applications using the LDAP identity store are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter those queries to enumerate accounts, infer attribute values, or steer which directory entry a login is checked against.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Jakarta Security LDAP identity store","fixed":[],"affected":"","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["jakarta-ee","java","ldap","package"],"not_affected_if":["no-ldap-identity-store","other-identity-store"],"how_to_check":"- Check whether the application uses the Jakarta Security LDAP identity store (look for LDAP identity store configuration in the app's security setup)\n- Check the version of the affected Jakarta Security component in the build file against `10.3.0` and `11.0.0-M2`","fix":null,"status":"open","published_at":"2026-11-10T15:17:12+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","triaged_at":"2026-11-10T15:23:07+00:00","updated_at":"2026-11-10T15:23:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T15:23:07Z","model":"claude-haiku-5-5","output":{"fix":"- Jakarta Security LDAP identity store: upgrade to `10.3.0` or `11.0.0-M2`","reach":"internet","title":"Jakarta Security LDAP store: caller name lets attackers alter directory queries","impact":"medium","summary":"The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter those queries to enumerate accounts, infer attribute values, or steer which directory entry a login is checked against.","audience":"businesses","category":"package","nicknames":[],"who_cares":["java","jakarta-ee","ldap"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker enumerates accounts and influences which directory entry logins check","analyst_note":"Confirm the exact affected component and artifact coordinates from the NVD entry or the project advisory; the sources do not name the library or its registry.","how_to_check":"- Check whether the application uses the Jakarta Security LDAP identity store (look for LDAP identity store configuration in the app's security setup)\n- Check the version of the affected Jakarta Security component in the build file against `10.3.0` and `11.0.0-M2`","plain_action":"","product_name":"Jakarta Security LDAP identity store","needs_analyst":true,"not_affected_if":["no-ldap-identity-store","other-identity-store"],"who_is_affected":"Only applications that use the LDAP identity store from Jakarta Security are affected. An unauthenticated remote attacker can send crafted caller names that change the directory query, so applications that log users in against LDAP are the ones to check. Applications that do not use the LDAP identity store can skip it.","user_interaction":"no","product_ecosystem":"maven","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001273,"input_tokens":4585,"output_tokens":1630,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111262':14A,17A '-2026':13A,16A '10.3.0':135C '11.0.0':137C 'account':60B,104C 'affect':127C 'alter':9A,55B,99C 'applic':120C 'attack':8A,53B,97C 'attribut':62B,107C 'caller':5A,42B,86C 'charact':39B,83C 'check':72B 'cve':12A,15A 'directori':10A,48B,67B,92C,106C,112C 'ee':25B 'entri':68B,113C 'enumer':59B,103C 'fix':140C 'ident':33B,77C,124C 'identity':21A 'infer':61B,105C 'influenc':110C 'issu':142C 'jakarta':1A,18A,24B,30B,74C 'jakarta-e':23B 'java':26B 'ldap':3A,20A,27B,32B,76C,123C 'let':7A 'login':70B,115C 'm2':138C 'name':6A,43B,87C 'neutral':37B,81C 'packag':28B 'queri':11A,49B,57B,93C,101C 'recommend':130C 'remot':51B,95C 'secur':2A,31B,75C 'security':19A 'special':38B,82C 'steer':65B 'store':4A,22A,34B,78C,125C 'unauthent':52B,96C 'upgrad':132C 'use':45B,89C,121C 'user':128C 'valid':117C 'valu':63B,108C 'version':134C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use the LDAP identity store from Jakarta Security are affected. An unauthenticated remote attacker can send crafted caller names that change the directory query, so applications that log users in against LDAP are the ones to check. Applications that do not use the LDAP identity store can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["jakartasecurityldapidentitystore"],"ptokens":["identity","jakarta","ldap","security","store"],"labels":["jakartaee","java","ldap","maven","package","unknown"],"campaign_type":null,"search_a":"'-111262':14A,17A '-2026':13A,16A 'alter':9A 'attack':8A 'caller':5A 'cve':12A,15A 'directori':10A 'identity':21A 'jakarta':1A,18A 'ldap':3A,20A 'let':7A 'name':6A 'queri':11A 'secur':2A 'security':19A 'store':4A,22A","search_b":"'account':60B 'alter':55B 'attack':53B 'attribut':62B 'caller':42B 'charact':39B 'check':72B 'directori':48B,67B 'ee':25B 'entri':68B 'enumer':59B 'ident':33B 'infer':61B 'jakarta':24B,30B 'jakarta-e':23B 'java':26B 'ldap':27B,32B 'login':70B 'name':43B 'neutral':37B 'packag':28B 'queri':49B,57B 'remot':51B 'secur':31B 'special':38B 'steer':65B 'store':34B 'unauthent':52B 'use':45B 'valu':63B","search_c":"'10.3.0':135C '11.0.0':137C 'account':104C 'affect':127C 'alter':99C 'applic':120C 'attack':97C 'attribut':107C 'caller':86C 'charact':83C 'directori':92C,106C,112C 'entri':113C 'enumer':103C 'fix':140C 'ident':77C,124C 'infer':105C 'influenc':110C 'issu':142C 'jakarta':74C 'ldap':76C,123C 'login':115C 'm2':138C 'name':87C 'neutral':81C 'queri':93C,101C 'recommend':130C 'remot':95C 'secur':75C 'special':82C 'store':78C,125C 'unauthent':96C 'upgrad':132C 'use':89C,121C 'user':128C 'valid':117C 'valu':108C 'version':134C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T15:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111262","severity":null,"published_at":"2026-11-10T15:17:12+00:00","modified_at":"2026-11-10T15:17:12+00:00","first_seen_at":"2026-11-10T15:22:22+00:00","fetched_at":"2026-11-10T15:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}