# CVE-2026-40193: foxcpp Maddy Mail Server LDAP filter injection in auth.ldap

Source: https://junglewise.ai/threats/cve-2026-40193-foxcpp-maddy-mail-server-ldap-filter-injection-in-auth-ldap  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-16. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40193 · Severity: high · CVSS 8.2 · Published 2026-04-16

Maddy Mail Server is an all-in-one email server solution. A vulnerability in its LDAP authentication module allows attackers to manipulate database queries by providing specially crafted usernames during login. This can lead to unauthorized access, the ability to impersonate other users, and the theft of sensitive directory information such as account details and password hashes.

Technologies: [github.com/foxcpp/maddy (Go)](https://junglewise.ai/threats/technologies/github-com-foxcpp-maddy). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-40193 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40193 being exploited in the wild.

**How severe is CVE-2026-40193?** High severity, with a CVSS score of 8.2, published 16 April 2026.

**Which products and versions are affected?** Foxcpp Maddy < 0.9.3; github.com/foxcpp/maddy (Go) < 0.9.3, SEMVER:introduced=0,fixed=0.9.3.

**Is there a fix for CVE-2026-40193?** Yes. github.com/foxcpp/maddy (Go): upgrade to 0.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40193 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40193?** Check whether you run Foxcpp Maddy, github.com/foxcpp/maddy (Go) or Maddy Project Maddy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/foxcpp/maddy (Go): upgrade to 0.9.3 or later

  ```sh
  go get github.com/foxcpp/maddy@v0.9.3
  ```


## Technical details

The `auth.ldap` module in Maddy Mail Server performs direct string interpolation of user-supplied usernames into LDAP search filters and Distinguished Name (DN) strings using `strings.ReplaceAll()`. Because the input is not escaped using `ldap.EscapeFilter()`, an attacker can inject LDAP filter operators (e.g., `*`, `(`, `)`) via the SMTP (AUTH PLAIN) or IMAP (LOGIN) interfaces. This enables boolean-based blind injection and timing side-channel attacks to enumerate directory structure and extract attribute values (like password hashes). The vulnerability is present in `internal/auth/ldap/ldap.go` and is fixed in version 0.9.3.

## Affected products

- foxcpp maddy < 0.9.3

## Identifiers

- CVE-2026-40193
- GHSA-5835-4gvc-32pc
- GO-2026-5137

## Timeline

- 2026-04-12: advisory: GitHub Advisory published
- 2026-04-13: disclosed
- 2026-04-16: other: Advisory updated

## References

- [https://api.github.com/users/RealHurrison](https://api.github.com/users/RealHurrison)
- [https://github.com/RealHurrison](https://github.com/RealHurrison)
- [https://api.github.com/users/RealHurrison/gists%7B/gist_id%7D](https://api.github.com/users/RealHurrison/gists%7B/gist_id%7D)
- [https://api.github.com/users/RealHurrison/repos](https://api.github.com/users/RealHurrison/repos)
- [https://avatars.githubusercontent.com/u/43513000?v=4](https://avatars.githubusercontent.com/u/43513000?v=4)
- [https://api.github.com/users/RealHurrison/events%7B/privacy%7D](https://api.github.com/users/RealHurrison/events%7B/privacy%7D)

## Related threats

- [GO-2022-0378 - MD5 hash support in github.com/foxcpp/maddy](https://junglewise.ai/threats/go-2022-0378-md5-hash-support-in-github-com-foxcpp-maddy-7794fc0d)
- [GO-2022-0374 - S3 storage write is not aborted on errors leading to unbounded memory usage in github.com/foxcpp/maddy](https://junglewise.ai/threats/go-2022-0374-s3-storage-write-is-not-aborted-on-errors-leading-to-80b1a56f)
- [GO-2022-0306 - Use of a Broken or Risky Cryptographic Algorithm in Max Mazurov Maddy in github.com/foxcpp/maddy](https://junglewise.ai/threats/cve-2021-42583-use-of-a-broken-or-risky-cryptographic-algorithm-in-max-mazurov)
- [GO-2023-1630 - Full authentication bypass if SASL authorization username is specified in github.com/foxcpp/maddy](https://junglewise.ai/threats/cve-2023-27582-full-authentication-bypass-if-sasl-authorization-username-is)
- [Use of a Key Past its Expiration Date and Insufficient Session Expiration in Maddy Mail Server](https://junglewise.ai/threats/cve-2022-24732-use-of-a-key-past-its-expiration-date-and-insufficient-session)