2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24130

CVE-2026-24130: Moonraker with LDAP Enabled Allows Malicious Search Filter Injection

Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. This issue has been fixed in version 0.10.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24130

CVE-2026-24130:

2.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moonraker	pip	< 0.10.0	0.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic LDAP injection issue within the moonraker.components.ldap.Ldap class. The analysis of the patch commit 74c5d8e44c4a4abbfbb06fb991e7ebb9ac947f42 clearly shows the vulnerability and its fix. The _perform_ldap_auth method was responsible for building the LDAP search filter. Before the patch, it directly embedded the user-provided username into the filter string, as seen in the removed lines: ldfilt = f"(&(objectClass=Person)({attr_name}={username}))" and ldfilt = self.user_filter.replace("USERNAME", username). This allows an attacker to inject arbitrary filter syntax. The fix involves using the escape_filter_chars function to sanitize the username before it is used, preventing the injection. The function authenticate_ldap_user is the asynchronous entry point that calls the vulnerable _perform_ldap_auth function, and both would likely be present in a runtime profile during an exploit attempt.

Vulnerable functions

Ldap._perform_ldap_auth

moonraker/components/ldap.py

This function constructs an LDAP search filter by directly concatenating the raw `username` parameter into the filter string. An attacker can provide a malicious username containing special LDAP filter characters to alter the search query, leading to LDAP injection. The patch mitigates this by sanitizing the username using `escape_filter_chars` before it is used in the filter.

Ldap.authenticate_ldap_user

moonraker/components/ldap.py

This function serves as the entry point for LDAP authentication. It receives the potentially malicious `username` from the login endpoint and passes it to the `_perform_ldap_auth` function, which then unsafely constructs an LDAP filter. This function would appear in a stack trace when the vulnerability is triggered.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.