# CVE-2026-44063: Netatalk LDAP filter injection in LDAP-backed operations

Source: https://junglewise.ai/threats/cve-2026-44063-netatalk-ldap-filter-injection-in-ldap-backed-operations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-44063 · Severity: medium · CVSS 4.2 · Published 2026-05-21

Netatalk, an open-source implementation of the Apple Filing Protocol (AFP) used for file sharing, contains a security flaw in how it handles LDAP directory lookups. An attacker with basic network access could potentially manipulate directory queries to bypass certain authorization checks or cause lookup errors. While this could lead to unauthorized access to information, it does not allow for remote code execution and is considered difficult to exploit in practice.

Technologies: [Netatalk](https://junglewise.ai/threats/technologies/netatalk). Vendors: [Netatalk](https://junglewise.ai/threats/vendors/netatalk).

## Quick answers

**Is CVE-2026-44063 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44063 being exploited in the wild.

**How severe is CVE-2026-44063?** Medium severity, with a CVSS score of 4.2, published 21 May 2026.

**Which products and versions are affected?** Netatalk 2.1.0 through 4.4.2.

**Is there a fix for CVE-2026-44063?** A patch was published on 2026-05-21: Fixed in version 4.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44063 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44063?** Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An LDAP filter injection vulnerability exists in Netatalk versions 2.1.0 through 4.4.2 due to improper neutralization of special elements used in LDAP queries (CWE-90). Specifically, LDAP search filters interpolate unescaped name values influenced by the client. In deployments utilizing LDAP-backed Access Control Lists (ACLs) or identity mapping, an authenticated attacker can craft malicious inputs to manipulate the resulting LDAP query. This can result in authorization bypass or identity lookup confusion. The attack requires low privileges but has high complexity (AC:H) due to the specific deployment requirements and input constraints. The issue is resolved in version 4.5.0 or by applying a specific security patch.

## Affected products

- Netatalk Netatalk 2.1.0 through 4.4.2

## Timeline

- 2026-05-13: disclosed: Initial disclosure date by Netatalk team
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Fixed in version 4.5.0

## References

- [https://netatalk.io/security/CVE-2026-44063](https://netatalk.io/security/CVE-2026-44063)

## Related threats

- [Netatalk afpd stack buffer overflow in deletedir()](https://junglewise.ai/threats/cve-2026-45698-netatalk-afpd-stack-buffer-overflow-in-deletedir)
- [Netatalk afpd stack buffer overflow in copydir()](https://junglewise.ai/threats/cve-2026-45699-netatalk-afpd-stack-buffer-overflow-in-copydir)
- [Netatalk TOCTOU race condition in ad_flush](https://junglewise.ai/threats/cve-2026-7837-netatalk-toctou-race-condition-in-ad-flush)
- [Netatalk missing break statement in DSI OpenSession](https://junglewise.ai/threats/cve-2026-44075-netatalk-missing-break-statement-in-dsi-opensession)
- [Netatalk incorrect calculation in ACL error handling](https://junglewise.ai/threats/cve-2026-44074-netatalk-incorrect-calculation-in-acl-error-handling)