{"id":"CVE-2026-121021","kind":"vulnerability","aliases":["CVE-2026-121021"],"related":[],"title":"AxxonSoft Axxon One: LDAP service account password stored in plaintext config","description":"Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service account via the main.conf configuration file.","summary":"Axxon One before 3.1.0 stores the password of its LDAP directory service account in plaintext in the main.conf file of the SecurityManager shared configuration. A local attacker who can read that configuration directory or its backups can recover the LDAP account password.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["axxon-one","ldap","linux","vendor","windows"],"not_affected_if":["no-ldap-integration","version-3.1.0-or-later"],"how_to_check":"- Check the installed Axxon One version and confirm whether it is earlier than `3.1.0`\n- Look for `main.conf` in the SecurityManager shared configuration directory and in any configuration backups, and check whether an LDAP password appears in plaintext","fix":"- Move to Axxon One `3.1.0` or later, per the NVD description (before 3.1.0 is affected)","status":"open","published_at":"2026-11-03T09:17:11+00:00","first_seen_at":"2026-11-03T09:19:51+00:00","triaged_at":"2026-11-03T09:20:24+00:00","updated_at":"2026-11-03T09:20:24+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-03T09:20:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move to Axxon One `3.1.0` or later, per the NVD description (before 3.1.0 is affected)","reach":"local","title":"AxxonSoft Axxon One: LDAP service account password stored in plaintext config","impact":"medium","summary":"Axxon One before 3.1.0 stores the password of its LDAP directory service account in plaintext in the main.conf file of the SecurityManager shared configuration. A local attacker who can read that configuration directory or its backups can recover the LDAP account password.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["axxon-one","ldap","windows","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"local attacker recovers the LDAP service account password from config","analyst_note":"","how_to_check":"- Check the installed Axxon One version and confirm whether it is earlier than `3.1.0`\n- Look for `main.conf` in the SecurityManager shared configuration directory and in any configuration backups, and check whether an LDAP password appears in plaintext\n- unknown whether other check paths exist","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.1.0-or-later","no-ldap-integration"],"who_is_affected":"Organizations running AxxonSoft Axxon One before 3.1.0 on Windows or Linux that integrate it with an LDAP directory. The exposure requires local read access to the configuration directory or to configuration backups, so the main concern is the servers and backup stores that hold those files. Systems not running Axxon One, or running 3.1.0 or later, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4147,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121021':14A,17A '-2026':13A,16A '-256':73C '3.1.0':28B,84C 'access':95C 'account':6A,37B,65B,113C 'allow':89C 'attack':51B,92C 'axxon':2A,19B,25B,81C 'axxon-on':18B 'axxonsoft':1A,80C 'backup':60B,103C 'config':11A 'configur':48B,56B,78C,98C,102C,117C 'cve':12A,15A 'cwe':72C 'directori':35B,57B,99C,111C 'file':43B,118C 'ldap':4A,21B,34B,64B,110C 'linux':22B,88C 'local':50B,91C 'main.conf':42B,116C 'obtain':105C 'one':3A,20B,26B,82C 'password':7A,31B,66B,71C,107C 'plaintext':10A,39B,67C 'read':54B,94C 'recov':62B 'securitymanag':46B,76C 'servic':5A,36B,112C 'share':47B,77C 'storag':68C 'store':8A,29B 'vendor':23B 'via':114C 'window':24B,86C","nicknames":[],"mitigations":[],"who_affected":"Organizations running AxxonSoft Axxon One before 3.1.0 on Windows or Linux that integrate it with an LDAP directory. The exposure requires local read access to the configuration directory or to configuration backups, so the main concern is the servers and backup stores that hold those files. Systems not running Axxon One, or running 3.1.0 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["axxonone","ldap","linux","medium","vendor","windows"],"first_public_at":"2026-11-03T09:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"15ede60e-6fda-426e-be9c-e788f151a377","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121021","severity":null,"published_at":"2026-11-03T09:17:11+00:00","modified_at":"2026-11-03T09:17:11+00:00","first_seen_at":"2026-11-03T09:19:51+00:00","fetched_at":"2026-11-03T09:19:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}