# CVE-2026-44671: ZITADEL LDAP injection in login flow

Source: https://junglewise.ai/threats/cve-2026-44671-zitadel-ldap-injection-in-login-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-44671 · Severity: high · CVSS 7.5 · Published 2026-05-14

ZITADEL, an identity management platform, contains a vulnerability in how it handles logins when connected to an LDAP directory. An unauthenticated attacker can use specially crafted usernames to trick the system into revealing whether specific users exist or to extract sensitive information from the directory. While this does not allow an attacker to log in without a password, it can lead to significant data exposure and user enumeration.

Technologies: [github.com/zitadel/zitadel (Go)](https://junglewise.ai/threats/technologies/github-com-zitadel-zitadel), [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-44671 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44671 being exploited in the wild.

**How severe is CVE-2026-44671?** High severity, with a CVSS score of 7.5, published 14 May 2026.

**Which products and versions are affected?** github.com/zitadel/zitadel (Go) SEMVER:introduced=0, SEMVER:introduced=4.0.0,fixed=4.15.0; ZITADEL 2.71.11 - 2.71.19, 3.1.0 - 3.4.9, 4.0.0 - 4.14.0, 4.0.0 to 4.14.0, 3.1.0 to 3.4.9, 2.71.11 to 2.71.19.

**Is there a fix for CVE-2026-44671?** Yes. github.com/zitadel/zitadel (Go): upgrade to 4.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44671 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44671?** Check whether you run github.com/zitadel/zitadel (Go) or ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/zitadel/zitadel (Go): upgrade to 4.15.0 or later

  ```sh
  go get github.com/zitadel/zitadel@v4.15.0
  ```


## Technical details

An LDAP Filter Injection vulnerability (CWE-90) exists in ZITADEL's LDAP identity provider implementation. The application fails to properly escape user-provided usernames before incorporating them into LDAP search filters during the login process. An unauthenticated attacker can use LDAP metacharacters (e.g., *, (, )) to perform blind LDAP injection. By analyzing the application's responses, an attacker can systematically enumerate valid usernames and extract sensitive attribute data from the connected LDAP directory. While authentication bypass is not possible, the confidentiality impact is high. Patches are available in versions 4.15.0, 3.4.10, and 2.71.20 (implied by the 2.x range fix).

## Affected products

- ZITADEL ZITADEL 4.0.0 to 4.14.0, 3.1.0 to 3.4.9, 2.71.11 to 2.71.19

## Identifiers

- CVE-2026-44671
- GHSA-rxvx-hhpj-q6px
- GO-2026-5648

## Timeline

- 2026-05-04: disclosed: Initial disclosure by ZITADEL
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-14: kev added: NVD publication date

## References

- [https://api.github.com/users/Proscan-one](https://api.github.com/users/Proscan-one)
- [https://github.com/Proscan-one](https://github.com/Proscan-one)
- [https://api.github.com/users/Proscan-one/gists%7B/gist_id%7D](https://api.github.com/users/Proscan-one/gists%7B/gist_id%7D)
- [https://api.github.com/users/Proscan-one/repos](https://api.github.com/users/Proscan-one/repos)
- [https://avatars.githubusercontent.com/u/269803746?v=4](https://avatars.githubusercontent.com/u/269803746?v=4)
- [https://api.github.com/users/Proscan-one/events%7B/privacy%7D](https://api.github.com/users/Proscan-one/events%7B/privacy%7D)

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)