The Apache Software Foundation has patched a critical security flaw in its widely used Apache CXF web services framework, warning that attackers could exploit an LDAP injection vulnerability to retrieve arbitrary X.509 certificates from enterprise LDAP-backed repositories, a risk with serious implications for PKI-reliant organizations.
Tracked as CVE-2026-44930 and rated “Important” severity, the flaw resides in the LDAP Certificate Repository of the XKMS (XML Key Management Specification) server component within Apache CXF.
Apache CXF LDAP Injection Flaw
Specifically, the vulnerable module org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap fails to properly neutralize user-supplied input before incorporating it into LDAP queries.
LDAP injection occurs when an application constructs LDAP filter strings using unsanitized external input, allowing an attacker to manipulate query logic, Colm O hEigeartaigh said.
In this case, a threat actor on the network could craft malicious inputs to bypass intended filters and extract certificates they are not authorized to access from the repository.
The flaw has a CVSS score of 9.8 (Critical) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-exploitable, no-privileges-required access.
CVE-2026-44930 is one of three vulnerabilities patched by Apache in the same release cycle . The companion flaws include:
- CVE-2026-44618 — An XXE (XML External Entity) injection flaw in the WS-Transfer functionality, enabling sensitive file reads and internal network reconnaissance
- CVE-2026-44417 — An incomplete fix for CVE-2025-48913, where untrusted JMS configuration could still lead to Remote Code Execution (RCE)
Security researchers note that this triple advisory underscores persistent injection, and Colm O hEigeartaigh noted that parser weaknesses exist across CXF’s enterprise-facing components.
Affected Versions
| CXF Branch | Vulnerable Versions | Patched Version |
|---|---|---|
| 4.2.x | 4.2.0 | 4.2.1 |
| 4.0.x – 4.1.x | 4.0.0 – 4.1.5 | 4.1.6 |
| 3.x | Before 3.6.11 | 3.6.11 |
Mitigation
Apache urges all users of the affected cxf-services-xkms-x509-repo-ldap module to immediately upgrade to versions 4.2.1, 4.1.6, or 3.6.11.
Deployments that do not use the XKMS LDAP Certificate Repository are not specifically exposed to CVE-2026-44930. Security teams should additionally:
- Audit LDAP access logs for anomalous filter patterns indicating prior exploitation
- Review all three CVEs patched in this cycle (CVE-2026-44930, CVE-2026-44618, CVE-2026-44417) for applicability
- Isolate JMS-facing CXF services until CVE-2026-44417 patches are fully validated
Its XKMS support is used for X.509 certificate lifecycle management in mature PKI environments, making unauthorized access to certificates a high-impact threat that can enable credential theft, man-in-the-middle attacks, and lateral movement within enterprise networks.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
