CVE-2026-27860

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-90

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-278674.8An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who hCVE-2026-278686.9An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) whCVE-2026-278696.9An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) whCVE-2026-27879.8Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8CVE-2026-278704.8An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who hCVE-2026-278712.9Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue afCVE-2026-278725.6- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects Easy IO FG: before 2.CVE-2026-278735.6- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: beforeCVE-2026-278745.0: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. TCVE-2026-278756.9Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire AdministratoCVE-2026-278769.1A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enaCVE-2026-278777.5When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.