---
id: "CVE-2026-111262"
page: "https://infrastack.ai/live/CVE-2026-111262"
kind: "vulnerability"
aliases: ["CVE-2026-111262"]
title: "Jakarta Security LDAP store: caller name lets attackers alter directory queries"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Jakarta Security LDAP identity store", "fixed": [], "affected": "", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["jakarta-ee", "java", "ldap", "package"]
not_affected_if: ["no-ldap-identity-store", "other-identity-store"]
published_at: "2026-11-10T15:17:12+00:00"
first_seen_at: "2026-11-10T15:22:22+00:00"
updated_at: "2026-11-10T15:23:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111262", "first_seen_at": "2026-11-10T15:22:22+00:00"}]
exploit_sources: []
---

# Jakarta Security LDAP store: caller name lets attackers alter directory queries

Link for people: https://infrastack.ai/live/CVE-2026-111262 (this .md is for agents)

The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter those queries to enumerate accounts, infer attribute values, or steer which directory entry a login is checked against.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:Jakarta Security LDAP identity store affected range not listed fixed no fixed version listed

## How to check

- Check whether the application uses the Jakarta Security LDAP identity store (look for LDAP identity store configuration in the app's security setup)
- Check the version of the affected Jakarta Security component in the build file against `10.3.0` and `11.0.0-M2`

## Timeline

- 2026-11-10T15:22:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111262

## From the sources

The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influence which directory entry the login is validated against. Only applications using the LDAP identity store are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_