CVE-2026-27860CWE-90

If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication

Low · published March 27, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
26.6
In the wild
Unconfirmed
What it is

If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00343 · 26.6th percentile
Weakness
CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published
2026-03-27T08:10Z
EPSS history
Timeline
  • 27 MAR 08:10Z
    If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication
    cvelistv5