by Kastro
Paper/Archive/CVE-2026-103547

CVE-2026-103547

OpenBSD OpenBSD — In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP…

EPSS 0.4%CVSS 9.2
critical.is priorityof 100
34
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 31.1.311 × 206.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)

Affected

ProductAffectedFixed inSource
OpenBSD7.8 – < errata 057errata 057CNA
OpenBSD7.9 – < errata 021errata 021CNA

Scores by source

mitre (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refopenbsd.org/errata79.htmlrefgithub.com/openbsd/src/commit/4f3f58e83c2a6d239c544236a9d4d76c74bbf960refftp.openbsd.org/pub/OpenBSD/patches/7.9/common/021_ldapd.patch.sigrefopenbsd.org/errata78.html