CVE-2026-116200: 
Snipe-IT vulnerability analysis and mitigation

CVE-2026-116200 is an LDAP StartTLS downgrade vulnerability in Snipe-IT, an open-source IT asset management application developed by Grokability, Inc. The flaw exists in Ldap::connectToLdap(), which calls ldap_start_tls() but discards its return value, silently allowing cleartext LDAP binds when TLS negotiation fails. All versions of Snipe-IT up to and including 8.6.2 are affected; version 8.6.3 contains the fix. It carries a CVSS v3.1 score of 5.9 (Medium) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory, Snipe-IT Advisory). The vulnerability was published on October 25, 2026, and assigned by VulnCheck.

The root cause is classified under CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-757 (Selection of Less-Secure Algorithm During Negotiation / Algorithm Downgrade). In app/Models/Ldap.php, the function connectToLdap() invokes PHP's ldap_start_tls($connection) but never checks whether it returns false, which PHP does when TLS negotiation fails. An on-path attacker can intercept the StartTLS extended request and respond with a protocol error before the legitimate LDAP server replies, causing the TLS upgrade to silently fail. Snipe-IT then proceeds to call ldap_bind() on the unencrypted connection, transmitting credentials in cleartext. Exploitation requires LDAP authentication to be enabled (ldap_enabled = 1) with StartTLS configured (ldap_tls = 1), and the attacker must have a network path between Snipe-IT and the LDAP server (e.g., shared L2 segment, compromised intermediate hop, or foothold in the same VPC/subnet) (Snipe-IT Advisory).

Successful exploitation exposes two distinct credential streams in cleartext over the network: the LDAP service-account credentials (ldap_uname / ldap_pword) used for directory search binds on every LDAP query, and the plaintext passwords of every end-user who logs in via findAndBindUserLdap(). Because the LDAP bind still succeeds from the user's perspective, the attack is entirely silent — users experience normal login behavior while their credentials are captured. Compromised service-account credentials could enable further lateral movement within the directory environment, including unauthorized access to other LDAP-integrated systems (Snipe-IT Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the disclosure date (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires an attacker to already have a privileged network position between Snipe-IT and the LDAP server, which raises the practical bar for opportunistic attacks.

1. Reconnaissance: Identify a Snipe-IT instance (version ≤ 8.6.2) configured with LDAP authentication and StartTLS (ldap_enabled = 1, ldap_tls = 1). Confirm network reachability between the Snipe-IT server and its LDAP server.
2. Establish on-path position: Gain a network position between the Snipe-IT application server and the LDAP server — for example, via ARP spoofing on a shared L2 segment, a compromised network device, or a foothold within the same VPC or subnet.
3. Intercept StartTLS request: Monitor TCP traffic on LDAP port 389. When Snipe-IT initiates a connection and sends the StartTLS extended request (OID 1.3.6.1.4.1.1466.20037), intercept it before it reaches the legitimate LDAP server.
4. Inject protocol error response: Respond to the StartTLS request with an LDAP ExtendedResponse containing a protocolError (result code 2) or similar error, causing ldap_start_tls() in PHP to return false.
5. Capture cleartext credentials: Because Snipe-IT ignores the false return value, it proceeds to call ldap_bind() on the unencrypted connection. Capture the LDAP bind request from the wire, which contains the service-account DN and password in plaintext. Repeat for each user login to harvest end-user passwords.
6. Leverage captured credentials: Use the harvested service-account or user credentials to authenticate to the LDAP directory or other integrated systems for lateral movement (Snipe-IT Advisory).

• Network: Unexpected LDAP ExtendedResponse packets with error result codes (e.g., protocolError) on port 389 between Snipe-IT and the LDAP server; LDAP BindRequest packets observed in cleartext (unencrypted) on port 389 where TLS would be expected; anomalous ARP traffic or unexpected MAC address changes on the network segment hosting Snipe-IT or the LDAP server.
• Logs: Snipe-IT application logs showing LDAP bind operations completing successfully without a preceding successful TLS handshake; absence of TLS-related log entries when ldap_tls = 1 is configured; LDAP server access logs showing bind requests originating from the Snipe-IT server IP without TLS session establishment.
• Network Monitoring: Packet captures revealing LDAP BindRequest PDUs containing simple authentication (plaintext password) on an unencrypted channel; network IDS alerts for cleartext LDAP authentication on port 389 from the Snipe-IT host (Snipe-IT Advisory).

Upgrade Snipe-IT to version 8.6.3 or later, which fixes the issue in commit 91ea06904f by checking the return value of ldap_start_tls() and throwing a STARTTLS Failed. exception if TLS negotiation does not succeed (Snipe-IT Advisory). As a compensating control prior to patching, implement network-level protections to prevent on-path attacks, such as network segmentation, VPN tunnels, or IPsec between Snipe-IT and the LDAP server. Alternatively, consider switching from StartTLS (port 389) to LDAPS (port 636), which establishes TLS before any LDAP communication and is not susceptible to this downgrade attack. Restrict network access to the LDAP port to only the Snipe-IT application server to reduce the attack surface.

The vulnerability was reported by researcher builtbybrayden and remediated by the Snipe-IT maintainer (snipe), as credited in the official GitHub Security Advisory (Snipe-IT Advisory). VulnCheck published an advisory and was credited as the CVE assigner (GitHub Advisory). No significant broader media coverage or notable social media discussion has been identified at this time.