{"id":"CVE-2026-116200","kind":"vulnerability","aliases":["CVE-2026-116200"],"related":[],"title":"Snipe-IT: LDAP StartTLS failure silently falls back to cleartext binds","description":"Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.","summary":"Snipe-IT before 8.6.3 ignores the return value of ldap_start_tls() when connecting to LDAP, so a failed TLS upgrade still sends the bind in cleartext. An on-path attacker can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["active-directory","ldap","package","self-hosted","snipe-it"],"not_affected_if":["ldap-disabled","ldaps-only","managed-hosting"],"how_to_check":"- Check the Snipe-IT version in `config/version.php` or the admin footer; affected if below `8.6.3`.\n- Check whether LDAP login is enabled and whether the LDAP server URL uses `ldap://` with StartTLS enabled in the LDAP settings.","fix":"- Upgrade Snipe-IT to `8.6.3` or later.\n- Until upgraded, use `ldaps://` (LDAP over TLS on port 636) so no StartTLS negotiation happens, and rotate the LDAP service-account password.","status":"open","published_at":"2026-10-25T14:17:00+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:22+00:00","updated_at":"2026-10-25T14:42:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:42:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Snipe-IT to `8.6.3` or later.\n- Until upgraded, use `ldaps://` (LDAP over TLS on port 636) so no StartTLS negotiation happens, and rotate the LDAP service-account password.","reach":"network","title":"Snipe-IT: LDAP StartTLS failure silently falls back to cleartext binds","impact":"high","summary":"Snipe-IT before 8.6.3 ignores the return value of ldap_start_tls() when connecting to LDAP, so a failed TLS upgrade still sends the bind in cleartext. An on-path attacker can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.","category":"package","nicknames":[],"who_cares":["snipe-it","self-hosted","ldap","active-directory"],"confidence":0.7,"needs_auth":"no","worst_case":"Service-account and user passwords are captured in cleartext on the network","analyst_note":"Confirm the fixed version (8.6.3) and the exact check for StartTLS use in the NVD entry or the Snipe-IT release notes.","how_to_check":"- Check the Snipe-IT version in `config/version.php` or the admin footer; affected if below `8.6.3`.\n- Check whether LDAP login is enabled and whether the LDAP server URL uses `ldap://` with StartTLS enabled in the LDAP settings.","needs_analyst":true,"not_affected_if":["ldap-disabled","ldaps-only","managed-hosting"],"who_is_affected":"Teams running self-hosted Snipe-IT before 8.6.3 with LDAP or Active Directory authentication configured to use StartTLS. An attacker needs a network position between the Snipe-IT server and the directory server. Installations without LDAP login, or using only ldaps:// with verified TLS, are not exposed to this downgrade.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":3337,"output_tokens":688,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116200':15A,18A '-2026':14A,17A '8.6.3':33B,87C 'account':75B,122C 'activ':20B 'active-directori':19B 'allow':98C 'answer':63B,110C 'attack':61B,102C,108C 'back':9A 'bind':12A,54B,107C 'captur':72B,119C 'cleartext':11A,56B,105C 'connect':43B 'connecttoldap':97C 'credenti':76B,123C 'cve':13A,16A 'directori':21B 'end':79B,126C 'end-us':78B,125C 'error':70B,117C 'fail':48B 'failur':6A 'fall':8A 'forc':104C 'host':26B 'ignor':34B,88C 'ldap':4A,22B,39B,45B,90C,96C,106C 'login':81B,128C 'on-path':58B,99C 'packag':23B 'password':82B,129C 'path':60B,101C 'protocol':69B,116C 'request':66B,113C 'return':36B,93C 'self':25B 'self-host':24B 'send':52B 'servic':74B,121C 'service-account':73B,120C 'silent':7A 'snipe':2A,28B,30B,84C 'snipe-it':1A,27B,29B,83C 'start':40B,91C 'starttl':5A,65B,112C 'still':51B 'tls':41B,49B,92C 'upgrad':50B 'user':80B,127C 'valu':37B,94C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Snipe-IT before 8.6.3 with LDAP or Active Directory authentication configured to use StartTLS. An attacker needs a network position between the Snipe-IT server and the directory server. Installations without LDAP login, or using only ldaps:// with verified TLS, are not exposed to this downgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116200","severity":null,"published_at":"2026-10-25T14:17:00+00:00","modified_at":"2026-10-25T14:17:00+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}