What’s Vulnerable › Vulnerabilities

CVE-2026-103547

• Severity: critical (CVSS 9.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-30 · updated 2026-10-01
• Weakness: CWE-863

Description

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)

Affected products

• OpenBSD: from 7.8 before errata 057; from 7.9 before errata 021 — fixed in errata 021, errata 057

How to fix

Upgrade to a fixed version: OpenBSD errata 021, errata 057. Check the vendor advisory for mitigations.

References

• https://ftp.openbsd.org/pub/OpenBSD/patches/7.9/common/021_ldapd.patch.sig
• https://github.com/openbsd/src/commit/4f3f58e83c2a6d239c544236a9d4d76c74bbf960
• https://www.openbsd.org/errata78.html
• https://www.openbsd.org/errata79.html

Get alerted when CVE-2026-103547 or the next vulnerability affects your stack