CVE-2026-10549

Vulnerability

An LDAP filter injection vulnerability exists in Yandex Database prior to version 25.3.1.25. This flaw allows a remote attacker who possesses valid LDAP credentials to bypass group membership checks. The vulnerability is present in the LDAP authentication mechanism.

Exploitation

A remote attacker with valid LDAP credentials can exploit this vulnerability. By crafting a malicious LDAP filter, the attacker can manipulate the authentication process to gain unauthorized access to the database, effectively bypassing intended group membership restrictions.

Impact

Successful exploitation of this vulnerability allows an attacker to bypass group membership checks, resulting in unauthorized access to the Yandex Database. This could lead to the disclosure of sensitive information or unauthorized modification of data, depending on the privileges associated with the bypassed group.

Mitigation

This vulnerability is fixed in Yandex Database version 25.3.1.25. Users are advised to upgrade to this version or a later release. No workarounds are disclosed in the available references. The provided reference [1] details other security fixes for YDB but does not specifically mention this LDAP filter injection vulnerability or its fix date.