Live › vulnerability › CVE-2026-58256
Go to dashboardGRR, a resource reservation application, writes LDAP connector settings such as ldap_filter into a PHP config file without sanitizing them. An administrator can inject PHP that the server then executes, giving remote code execution on the host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 23:29 UTC. All times on this page are UTC.
Installations of GRR before the advisory-reported fixed version 4.5.0 that use the LDAP connector are exposed. Exploitation requires an administrator account, and the sources say the admin must connect to an LDAP server, which may be attacker-controlled. Teams not running GRR, or running 4.5.0 or later, can skip it.
No product ranges from the sources yet.
4.5.0 are listed as affected./personnalisation/config_ldap.inc.php for PHP code inside LDAP filter or other connector values that you did not write.4.5.0 or later, per the advisory.config_ldap.inc.php file for injected code, and rotate any credentials the server could read if it was tampered with.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldap_filter, poisoning /personnalisation/config_ldap.inc.php and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-58256")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.