CVE-2026-44930

[CVE catalog]

Severity

Critical · CVSS 9.8

Published

May 21, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.72% · Oct 25, 2026

A flaw was found in Apache CXF. A remote attacker could exploit an LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server. This vulnerability allows the attacker to retrieve arbitrary certificates from the repository, leading to information disclosure. apache-cxf: org.apache.cxf.services.xkms/cxf-services-xkms-x509-repo-ldap: Apache CXF: Information Disclosure via LDAP Injection This is an Important information disclosure flaw in Apache CXF's XKMS server, allowing a remote attacker to retrieve arbitrary certificates via an LDAP injection vulnerability in the LDAP Certificate repository. This impact is considered Important due to the potential for unauthorized access to sensitive cryptographic material without requiring prior authentication, affecting the confidentiality of services utilizing the cxf-services-xkms-x509-repo-ldap component in Red Hat products. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.