{"id":"CVE-2026-57193","kind":"vulnerability","aliases":["CVE-2026-57193"],"related":[],"title":"Asterisk: LDAP filter injection via SIP username leaks directory data","description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","summary":"Asterisk's res_config_ldap realtime driver does not sanitize the SIP username before building an LDAP query, so an attacker can send crafted SIP packets to run arbitrary LDAP queries. The attacker can disclose information from the connected LDAP directory without logging in.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asterisk","ldap","package","pbx","voip"],"not_affected_if":["default-config","no-ldap-realtime"],"how_to_check":"- Run `asterisk -rx \"module show like res_config_ldap\"` to see whether the module is loaded.\n- Check `extconfig.conf` and `res_ldap.conf` for LDAP realtime mappings in use.\n- Check the installed Asterisk version with `asterisk -V`.","fix":"- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`, or Certified Asterisk `20.7-cert11` or `22.8-cert3`.\n- If the upgrade cannot happen now, unload the module with `asterisk -rx \"module unload res_config_ldap\"` or stop using LDAP realtime.","status":"open","published_at":"2026-10-26T20:17:56+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","triaged_at":"2026-10-26T20:51:44+00:00","updated_at":"2026-10-26T20:51:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-26T20:51:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Asterisk to `20.20.1`, `21.12.3`, `22.10.1` or `23.4.1`, or Certified Asterisk `20.7-cert11` or `22.8-cert3`.\n- If the upgrade cannot happen now, unload the module with `asterisk -rx \"module unload res_config_ldap\"` or stop using LDAP realtime.","reach":"network","title":"Asterisk: LDAP filter injection via SIP username leaks directory data","impact":"low","summary":"Asterisk's res_config_ldap realtime driver does not sanitize the SIP username before building an LDAP query, so an attacker can send crafted SIP packets to run arbitrary LDAP queries. The attacker can disclose information from the connected LDAP directory without logging in.","category":"package","nicknames":[],"who_cares":["asterisk","pbx","voip","ldap"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads data from the LDAP directory via crafted SIP packets","analyst_note":"","how_to_check":"- Run `asterisk -rx \"module show like res_config_ldap\"` to see whether the module is loaded.\n- Check `extconfig.conf` and `res_ldap.conf` for LDAP realtime mappings in use.\n- Check the installed Asterisk version with `asterisk -V`.","needs_analyst":false,"not_affected_if":["default-config","no-ldap-realtime"],"who_is_affected":"Only systems that load and configure res_config_ldap to read from an LDAP server are exposed, which is not the default. The SIP listener must also be reachable by the attacker, so PBXs exposed to the internet with LDAP realtime are the main concern. Installations that use only file-based or database realtime can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":3478,"output_tokens":653,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-57193':13A,16A '20.20.1':79C,149C '20.7':86C,156C '21.12.3':80C,150C '22.10.1':81C,151C '22.8':88C,158C '23.4.1':82C,152C 'access':134C 'allow':106C 'arbitrari':50B,112C 'asterisk':1A,17B,22B,65C,78C,85C,148C,155C 'attack':42B,54B,109C 'branch':71C 'build':36B 'care':116C 'cert11':87C,157C 'cert3':89C,159C 'certifi':84C,154C 'config':25B,95C,125C 'configur':132C 'connect':60B 'craft':45B,117C 'cve':11A,14A 'data':10A 'default':142C 'directori':9A,62B 'disclos':56B,121C 'driver':28B,93C 'exchang':72C 'filter':3A,100C 'fix':146C 'inform':57B,122C 'inject':4A,101C 'issu':144C 'ldap':2A,18B,26B,38B,51B,61B,91C,96C,99C,113C,126C,136C 'leak':8A 'load':130C 'log':64B 'make':111C 'may':97C 'modul':127C 'must':128C 'open':68C 'packag':19B 'packet':47B,119C 'pbx':20B 'permit':98C 'prior':76C 'privat':70C 'queri':39B,52B,114C 'realtim':27B,92C 'res':24B,94C,124C 'run':49B 'sanit':31B 'send':44B 'server':137C 'sip':6A,33B,46B,104C,118C 'sourc':69C 'telephoni':74C 'toolkit':75C 'unauthent':108C 'use':115C 'usernam':7A,34B,105C 'via':5A 'voip':21B 'without':63B","nicknames":[],"mitigations":[],"who_affected":"Only systems that load and configure res_config_ldap to read from an LDAP server are exposed, which is not the default. The SIP listener must also be reachable by the attacker, so PBXs exposed to the internet with LDAP realtime are the main concern. Installations that use only file-based or database realtime can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T20:17:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57193","severity":null,"published_at":"2026-10-26T20:17:56+00:00","modified_at":"2026-10-26T20:17:56+00:00","first_seen_at":"2026-10-26T20:50:17+00:00","fetched_at":"2026-10-26T20:50:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}