Live › vulnerability › CVE-2026-57193
Go to dashboardAsterisk's res_config_ldap realtime driver does not sanitize the SIP username before building an LDAP query, so an attacker can send crafted SIP packets to run arbitrary LDAP queries. The attacker can disclose information from the connected LDAP directory without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.
Only systems that load and configure res_config_ldap to read from an LDAP server are exposed, which is not the default. The SIP listener must also be reachable by the attacker, so PBXs exposed to the internet with LDAP realtime are the main concern. Installations that use only file-based or database realtime can skip it.
No product ranges from the sources yet.
asterisk -rx "module show like res_config_ldap" to see whether the module is loaded.extconfig.conf and res_ldap.conf for LDAP realtime mappings in use.asterisk -V.20.20.1, 21.12.3, 22.10.1 or 23.4.1, or Certified Asterisk 20.7-cert11 or 22.8-cert3.asterisk -rx "module unload res_config_ldap" or stop using LDAP realtime.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver res_config_ldap may permit LDAP filter injection through a SIP username, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The res_config_ldap module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
This page as .md · .json · in your agent: get_signal("CVE-2026-57193")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.