CVE-2026-40193
Maddy Project Maddy ≤ 0.9.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NSummary
CVE-2026-40193 is a high-severity LDAP Injection (CWE-90) vulnerability in Maddy Project Maddy. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40193 is an LDAP injection vulnerability (CWE-90) in the auth.ldap module of maddy, a composable all-in-one mail server. Versions prior to 0.9.3 interpolate user-supplied usernames into LDAP search filters and DN strings using strings.ReplaceAll() without LDAP filter escaping, even though the go-ldap/ldap/v3 library's ldap.EscapeFilter() function is available in the same import. The flaw affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter.
An attacker with network access to the SMTP submission or IMAP interface can exploit this vulnerability by injecting arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or timing side-channels between distinct failure paths. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
The issue was fixed in maddy version 0.9.3. Mitigation requires upgrading to this version or later. Additional details are available in the GitHub security advisory (https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc), release notes (https://github.com/foxcpp/maddy/releases/tag/v0.9.3), and the patching commit (https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23131
Vulnerability Data
maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite…
more
the go-ldap/ldap/v3 library's ldap.EscapeFilter() function being available in the same import. This affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths. This issue has been fixed in version 0.9.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.6
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover LDAP injection flaws through static analysis or crafted test cases.
Input validation directly stops untrusted data from reaching an LDAP query builder without neutralization of special characters.
Secure engineering principles require safe query construction and escaping that structurally prevents LDAP injection.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and query parameterization to prevent LDAP injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches LDAP injection via dynamic analysis or fuzzing, but does not prevent it at the source.
Secure development lifecycle mandates input validation and query construction practices that directly prevent LDAP injection.
Application security requirements include explicit rules for safe construction of directory queries, mitigating LDAP injection.
Secure coding standards require proper neutralization of LDAP special characters, directly eliminating this weakness.
Secure architecture principles encourage safe query interfaces but do not prescribe the specific coding controls needed for LDAP injection.
Information access restriction limits who can query LDAP but does not address how queries are built.