Skip to content

CVE-2026-44930 — Apache CXF

Key facts

CVE-2026-44930 (Apache Software Foundation) is a Critical (9.8) vulnerability: Apache CXF. This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.
CVE CVE-2026-44930
Severity Critical (9.8)
Vendor Apache Software Foundation
Product Apache CXF
Detection / prevention Snort
PoC poc.py
Source 2026/CVE-2026-44930/

Details

CVE-2026-44930 (Apache Software Foundation) is a Critical (9.8) vulnerability: Apache CXF. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort) — see Detection and prevention below. Source: NVD record.

Overview

Field Value
CVE CVE-2026-44930
CVSS 9.8 (Critical)
Vendor Apache Software Foundation
Product Apache CXF
Affected Apache CXF versions using XKMS certificate repository with LDAP backend
Fixed Upgrade Apache CXF to patched version; disable XKMS if unused

Root Cause

Apache CXF's XML Key Management Specification (XKMS) service implementation passes user-controlled certificate query parameters directly into LDAP search filter strings without sanitization or escaping. When the XKMS service is configured to use an LDAP-backed certificate repository, values such as the subject distinguished name (DN), key ID, or certificate serial number supplied in XKMS Locate or Validate requests are interpolated into LDAP filter expressions. Special LDAP metacharacters (*, (, ), \, NUL) are not escaped per RFC 4515, resulting in a classic LDAP injection vulnerability (CWE-90).

Problem

An unauthenticated network attacker who can reach the XKMS endpoint can manipulate LDAP queries to:

  • Retrieve arbitrary certificates: Inject filter wildcards (*) to enumerate and extract all certificates stored in the LDAP directory, including internal CA certificates and service certificates not intended for external access.
  • Authentication bypass: In deployments where XKMS is used for certificate-based authentication, inject filters that cause the LDAP query to match unexpected entries, bypassing certificate validation checks.
  • LDAP directory reconnaissance: Enumerate LDAP directory structure, user accounts, groups, and organizational units by injecting filter logic.
  • Information disclosure: Extract sensitive attributes from LDAP objects beyond the certificate store if the CXF service account has broad LDAP read permissions.

Detection

Run the proof-of-concept against your Apache CXF XKMS endpoint:

python poc.py --endpoint https://<cxf-host>/services/XKMS --inject "*)(objectClass=*"

The PoC sends a crafted XKMS LocateRequest with an injected LDAP filter fragment in the query criteria. A vulnerable server returns certificate entries that should not match the original query, or returns an error exposing LDAP filter syntax in the message.

Manual XKMS request test: 

<xkms:LocateRequest xmlns:xkms="...">
  <xkms:QueryKeyBinding>
    <ds:KeyInfo><ds:X509Data><ds:X509SubjectName>
      CN=test*)(objectClass=*
    </ds:X509SubjectName></ds:X509Data></ds:KeyInfo>
  </xkms:QueryKeyBinding>
</xkms:LocateRequest>

Remediation

  1. Upgrade Apache CXF: Update to the patched version of Apache CXF that implements proper LDAP filter escaping using the LdapEncoder.filterEncode() method or equivalent before incorporating user input into search filters.
  2. Disable XKMS if unused: If your deployment does not require XKMS certificate services, disable the endpoint in cxf.xml or beans.xml by removing the XKMS service bean registration.
  3. Apply LDAP input sanitization: As an interim mitigation, deploy a CXF interceptor that strips or escapes LDAP special characters (* ( ) \ NUL) from all XKMS request parameters.
  4. Restrict LDAP service account permissions: Configure the LDAP bind account used by CXF to have read access only to the certificate subtree, preventing broader directory enumeration.
  5. Network-level access control: Restrict access to the XKMS endpoint at the network layer using firewall rules or reverse proxy ACLs, allowing only trusted certificate management systems.
  6. Audit LDAP access logs: Review LDAP server access logs for queries containing metacharacters or unusually broad wildcard patterns originating from the CXF service account.

References

  • NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-44930
  • Apache CXF Security Advisories: https://cxf.apache.org/security-advisories.html
  • RFC 4515 - LDAP Search Filter Escaping: https://datatracker.ietf.org/doc/html/rfc4515
  • OWASP LDAP Injection Prevention: https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-44930, for authorized testing and blue-team detection engineering:

References: NVD — CVE-2026-44930 · full write-up on the searchable site

Detection & prevention rules

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"CVE-2026-44930 Apache CXF XKMS LDAP injection special chars"; flow:to_server,established; content:"XKMS"; http_client_body; nocase; pcre:"/(?:\(\|\(|\(\&\(|\*\)|\\00|%00)/"; http_client_body; classtype:web-application-attack; sid:9002703; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"CVE-2026-44930 Apache CXF XKMS LDAP filter injection in KeyName"; flow:to_server,established; content:"KeyName"; http_client_body; nocase; pcre:"/KeyName>[^<]*(?:\*|\(|\)|\\)[^<]*</i"; http_client_body; classtype:web-application-attack; sid:9002704; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"CVE-2026-44930 Apache CXF XKMS certificate lookup LDAP null byte"; flow:to_server,established; content:"QueryKeyBinding"; http_client_body; nocase; pcre:"/(?:\\00|%00|\x00)/"; http_client_body; classtype:web-application-attack; sid:9002705; rev:1;)

:material-file-download: prevention/snort.rules

Frequently asked questions

What is CVE-2026-44930?

CVE-2026-44930 (Apache Software Foundation) is a Critical (9.8) vulnerability: Apache CXF. This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-44930?

Deploy the Snort detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-44930?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

Other entries for the same vendor or product:

For authorized security testing and research only. See the full source and NVD record.