Is CVE-2026-103547 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103547 being exploited in the wild.

How severe is CVE-2026-103547?

Informational severity, published 30 September 2026.

Which products and versions are affected?

Openbsd 7.8 before errata 057; 7.9 before errata 021.

Is there a fix for CVE-2026-103547?

A patch was published on 2026-09-14: errata 021 released for OpenBSD 7.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103547 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-103547?

Check whether you run Openbsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103547: OpenBSD ldapd LDAP Bind authentication confusion attack

CVE-2026-103547 · Severity: info · Published 2026-09-30

OpenBSD's ldapd, an LDAP directory service component, uses connection identifiers to track delegated authentication requests. A remote attacker can authenticate as another user by exploiting identifier reuse when TCP connections close and new connections reuse the same file descriptor. The vulnerability also risks crashes from NULL pointer dereference when connections terminate unexpectedly.

Technologies: Openbsd. Vendors: OpenBSD.

Quick answers

Is CVE-2026-103547 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103547 being exploited in the wild.
How severe is CVE-2026-103547?: Informational severity, published 30 September 2026.
Which products and versions are affected?: Openbsd 7.8 before errata 057; 7.9 before errata 021.
Is there a fix for CVE-2026-103547?: A patch was published on 2026-09-14: errata 021 released for OpenBSD 7.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103547 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-103547?: Check whether you run Openbsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from ldapd correlating authentication results using only the socket file descriptor and LDAP message ID. When a TCP connection closes, a new connection may reuse the freed file descriptor. An attacker who controls the timing can cause authentication results destined for one connection to be delivered to another, achieving unauthorized Bind. The patch replaces file descriptor tracking with a monotonic 64-bit connection ID, and adds NULL pointer checks to prevent crashes.

Affected products

OpenBSD OpenBSD 7.8 before errata 057; 7.9 before errata 021

Timeline

2026-09-30: disclosed
2026-09-14: patched: errata 021 released for OpenBSD 7.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.