CVE-2026-27860

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-27 · updated 2026-10-26
Weakness: CWE-90

Description

If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.

Affected products

dovecot: before 2.4.3 — fixed in 2.4.3
Open-Xchange Dovecot: before 3.1.4 — fixed in 3.1.4

How to fix

Upgrade to a fixed version: dovecot 2.4.3; Open-Xchange Dovecot 3.1.4. Check the vendor advisory for mitigations.

References

https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json

Get alerted when CVE-2026-27860 or the next vulnerability affects your stack