Is CVE-2026-44671 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44671 being exploited in the wild.

How severe is CVE-2026-44671?

High severity, with a CVSS score of 7.5, published 14 May 2026.

Which products and versions are affected?

github.com/zitadel/zitadel (Go) SEMVER:introduced=0, SEMVER:introduced=4.0.0,fixed=4.15.0; ZITADEL 2.71.11 - 2.71.19, 3.1.0 - 3.4.9, 4.0.0 - 4.14.0, 4.0.0 to 4.14.0, 3.1.0 to 3.4.9, 2.71.11 to 2.71.19.

Is there a fix for CVE-2026-44671?

Yes. github.com/zitadel/zitadel (Go): upgrade to 4.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44671 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44671?

Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44671: ZITADEL LDAP injection in login flow

CVE-2026-44671 · Severity: high · CVSS 7.5 · Published 2026-05-14

ZITADEL, an identity management platform, contains a vulnerability in how it handles logins when connected to an LDAP directory. An unauthenticated attacker can use specially crafted usernames to trick the system into revealing whether specific users exist or to extract sensitive information from the directory. While this does not allow an attacker to log in without a password, it can lead to significant data exposure and user enumeration.

Technologies: github.com/zitadel/zitadel (Go), ZITADEL. Vendors: Go, ZITADEL.

Quick answers

Is CVE-2026-44671 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44671 being exploited in the wild.
How severe is CVE-2026-44671?: High severity, with a CVSS score of 7.5, published 14 May 2026.
Which products and versions are affected?: github.com/zitadel/zitadel (Go) SEMVER:introduced=0, SEMVER:introduced=4.0.0,fixed=4.15.0; ZITADEL 2.71.11 - 2.71.19, 3.1.0 - 3.4.9, 4.0.0 - 4.14.0, 4.0.0 to 4.14.0, 3.1.0 to 3.4.9, 2.71.11 to 2.71.19.
Is there a fix for CVE-2026-44671?: Yes. github.com/zitadel/zitadel (Go): upgrade to 4.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44671 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44671?: Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/zitadel/zitadel (Go): upgrade to 4.15.0 or later
```
go get github.com/zitadel/zitadel@v4.15.0
```

Technical details

An LDAP Filter Injection vulnerability (CWE-90) exists in ZITADEL's LDAP identity provider implementation. The application fails to properly escape user-provided usernames before incorporating them into LDAP search filters during the login process. An unauthenticated attacker can use LDAP metacharacters (e.g., *, (, )) to perform blind LDAP injection. By analyzing the application's responses, an attacker can systematically enumerate valid usernames and extract sensitive attribute data from the connected LDAP directory. While authentication bypass is not possible, the confidentiality impact is high. Patches are available in versions 4.15.0, 3.4.10, and 2.71.20 (implied by the 2.x range fix).

Affected products

ZITADEL ZITADEL 4.0.0 to 4.14.0, 3.1.0 to 3.4.9, 2.71.11 to 2.71.19

Identifiers

CVE-2026-44671
GHSA-rxvx-hhpj-q6px
GO-2026-5648

Timeline

2026-05-04: disclosed: Initial disclosure by ZITADEL
2026-05-08: advisory: GitHub Advisory published
2026-05-14: kev added: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.