Live › vulnerability › CVE-2026-116200
Go to dashboardSnipe-IT before 8.6.3 ignores the return value of ldap_start_tls() when connecting to LDAP, so a failed TLS upgrade still sends the bind in cleartext. An on-path attacker can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams running self-hosted Snipe-IT before 8.6.3 with LDAP or Active Directory authentication configured to use StartTLS. An attacker needs a network position between the Snipe-IT server and the directory server. Installations without LDAP login, or using only ldaps:// with verified TLS, are not exposed to this downgrade.
No product ranges from the sources yet.
config/version.php or the admin footer; affected if below 8.6.3.ldap:// with StartTLS enabled in the LDAP settings.8.6.3 or later.ldaps:// (LDAP over TLS on port 636) so no StartTLS negotiation happens, and rotate the LDAP service-account password.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.
This page as .md · .json · in your agent: get_signal("CVE-2026-116200")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.