8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40193

CVE-2026-40193: Maddy Mail Server: LDAP Filter Injection via Unsanitized Username

maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the go-ldap/ldap/v3 library's ldap.EscapeFilter() function being available in the same import. This affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths. This issue has been fixed in version 0.9.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40193

CVE-2026-40193:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/foxcpp/maddy	go	< 0.9.3	0.9.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an LDAP injection in the Maddy Mail Server's auth.ldap module. The root cause is the direct use of unsanitized user-supplied usernames in LDAP search filters and DN templates. The provided patch 6a06337eb41fa87a35697366bcb71c3c962c44ba clearly shows that the username variable was being used without escaping in internal/auth/ldap/ldap.go.

Two functions are identified as vulnerable:

Auth.Lookup: This function was vulnerable to LDAP filter injection because it used strings.ReplaceAll to substitute the username directly into the filter. The patch fixes this by wrapping the username with ldap.EscapeFilter.
Auth.AuthPlain: This function contained two injection points. If a dn_template was configured, it was vulnerable to DN injection, fixed by using ldap.EscapeDN. Otherwise, it was vulnerable to the same LDAP filter injection as Auth.Lookup, fixed by using ldap.EscapeFilter.

An attacker could exploit this by providing a crafted username during SMTP (AUTH PLAIN) or IMAP (LOGIN) authentication. This could lead to identity spoofing, enumeration of LDAP directory contents, and extraction of sensitive attributes through boolean-based blind or timing-based side-channel attacks. The identified functions, Auth.Lookup and Auth.AuthPlain, are the direct entry points for this vulnerability and would appear in a runtime profile during an exploitation attempt.

Vulnerable functions

Auth.Lookup

internal/auth/ldap/ldap.go

The function constructs an LDAP search filter by replacing '{username}' in a template with a raw, user-supplied username without any escaping. This allows an attacker to inject arbitrary LDAP filter syntax, leading to LDAP injection.

Auth.AuthPlain

internal/auth/ldap/ldap.go

This function has two vulnerabilities. First, it constructs a user DN string from a template by replacing '{username}' with the raw username, making it vulnerable to DN template injection if `dn_template` is configured. Second, if `dn_template` is not used, it constructs an LDAP search filter in the same vulnerable way as the `Lookup` function, allowing LDAP filter injection. Both vulnerabilities occur because the user-supplied `username` is not escaped.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.