CVE-2026-74241

The record

A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling user-existence oracle attacks at the referral Directory Name (DN). This could also potentially influence which DN is used for password binding in multi-domain Active Directory environments.

Affected packages

Related vulnerabilities

• CVE-2026-15723 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before… CWE-90
• CVE-2026-80055 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-90
• CVE-2026-75020 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')… CWE-90
• CVE-2026-19271 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')… CWE-90
• CVE-2026-76373 In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with… CWE-90
• CVE-2026-19930 A security flaw has been discovered in Dolibarr up to 23.0.3. CWE-90
• CVE-2026-16071 A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user… CWE-90
• CVE-2026-59652 In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4… CWE-90