All vulnerabilities
CVE-2026-94052

Apache MINA SSHD: LDAP password authentication ineffective

Apache Software Foundation Apache MINA SSHD
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.20.0Also 3.0.0-M6CVE List
Published30 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks.

Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server.

sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is _not_ affected by this vulnerability, which concerns only LdapPasswordAuthenticator.

Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue.

Text from CVE List

Affected versions 2

  • Apache MINA SSHDaffected: 1.2.0 before 2.20.0CVE List
  • Apache MINA SSHDaffected: 3.0.0-M1 before 3.0.0-M6CVE List

References 1