Quick answers
- Is CVE-2026-11748 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11748 being exploited in the wild.
- How severe is CVE-2026-11748?
- Medium severity, with a CVSS score of 4, published 22 June 2026.
- Which products and versions are affected?
- LY Corporation Central Dogma < 0.84.0; com.linecorp.centraldogma:centraldogma-server-auth-shiro (Maven) < 0.84.0, ECOSYSTEM:introduced=0,fixed=0.84.0.
- Is there a fix for CVE-2026-11748?
- Yes. com.linecorp.centraldogma:centraldogma-server-auth-shiro (Maven): upgrade to 0.84.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-11748 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-11748?
- Check whether you run LY Corporation Central Dogma or com.linecorp.centraldogma:centraldogma-server-auth-shiro (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- com.linecorp.centraldogma:centraldogma-server-auth-shiro (Maven): upgrade to 0.84.0 or later
# set com.linecorp.centraldogma:centraldogma-server-auth-shiro to 0.84.0 in your pom.xml or build.gradle
Technical details
The vulnerable code in SearchFirstActiveDirectoryRealm.findUserDn() uses Pattern.replaceAll() to substitute a user-supplied username into an LDAP filter template (default: "cn={0}") without escaping RFC 4515 filter metacharacters: *, (, ), \, and NUL. The vulnerability flows from the HTTP login form through ShiroLoginService.usernamePassword() and directly into the LDAP filter construction. Combined with SearchControls.setCountLimit(1), which returns only the first directory match, an attacker can type "*" to land on the first directory entry (typically Administrator) and attempt authentication with any known password. Malformed filter payloads like "bob)(uid=alice" are recorded verbatim in audit logs while the LDAP search fails silently, breaking compliance accountability. The defense (RFC 4515 escaping) was never implemented; repo-wide search for escapeLdap, encodeFilter, escapeFilter, or ldapEscape returns zero hits. Patch version 0.84.0 adds the encodeLdapFilter() helper and applies it before filter substitution.
Affected products
- LINE Central Dogma < 0.84.0
Identifiers
- CVE-2026-11748
- GHSA-98q5-5qh2-7w75
Timeline
- 2026-06-22: disclosed
- 2026-06-22: patched: Fixed in version 0.84.0