CVE-2026-21880: 
NixOS vulnerability analysis and mitigation

CVE-2026-21880 is an LDAP Injection vulnerability in Kanboard's LDAP authentication mechanism affecting versions 1.2.48 and below. User-supplied input is directly substituted into LDAP search filters without proper sanitization, enabling unauthenticated attackers to enumerate all LDAP users, discover sensitive user attributes (usernames, emails, full names), and perform targeted reconnaissance against specific accounts. The vulnerability was discovered in December 2025, reported by researcher HUSEYNKHANLI, and publicly disclosed on January 7–8, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query) and CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerable code resides in app/Core/Ldap/User.php within the getLdapUserPattern() function (line 356), which uses str_replace('%s', $username, $filter) to build LDAP search filters without calling PHP's ldap_escape() function. An unauthenticated attacker can submit LDAP metacharacters (e.g., *) as the username in the login form, causing the constructed filter to become (uid=*), which instructs the LDAP server to return all directory entries. A similar issue exists in app/Group/LdapBackendGroupProvider.php in the getLdapGroupPattern() function. No authentication or special privileges are required; the attack is network-accessible with low complexity (GitHub Advisory, Patch Commit).

Successful exploitation allows unauthenticated attackers to enumerate all users in the connected LDAP directory, exposing usernames, email addresses, full names, and other LDAP attributes. This information disclosure can facilitate targeted credential-stuffing, phishing, or brute-force attacks against identified accounts, including administrator accounts. Importantly, true authentication bypass (logging in without a valid password) is not possible with this vulnerability alone, as the LDAP bind operation still validates credentials; the impact is limited to confidentiality (GitHub Advisory).

A proof-of-concept exploit script (Python) was developed and verified by the reporter in a live test environment prior to disclosure, and is included in the public GitHub Security Advisory. The exploit requires no authentication and is trivially executable via a simple HTTP POST to the login endpoint with a wildcard payload. The EPSS score is approximately 0.00102 (low probability of widespread exploitation), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing as of the disclosure date (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Kanboard instances running version 1.2.48 or earlier with LDAP authentication enabled (check the login page or HTTP headers for Kanboard version indicators).
2. Obtain CSRF Token: Send a GET request to the Kanboard login page (/login) and extract the csrf_token value from the HTML form using a regex or HTML parser.
3. Craft LDAP Injection Payload: Prepare a POST request to /?controller=AuthController&action=check with the csrf_token, password=test (any value), and username=* (wildcard) or username=admin* (targeted prefix).
4. Submit Injection: Send the crafted POST request. The vulnerable getLdapUserPattern() function substitutes the unsanitized username directly into the LDAP filter, producing (uid=*) or (uid=admin*), which is sent to the LDAP server.
5. Observe LDAP Server Response: The LDAP server executes the injected filter and returns all matching directory entries (users, emails, full names) to Kanboard. The attacker does not see these results directly in the HTTP response but can confirm injection via LDAP server logs or by observing timing/behavioral differences.
6. Enumerate Users: Iterate through prefix payloads (e.g., a*, b*, ...) to enumerate usernames character by character, or use the wildcard to trigger a full directory dump observable in LDAP logs or via side-channel analysis.
7. Targeted Follow-up: Use discovered usernames and emails for phishing, credential stuffing, or brute-force attacks against the Kanboard or LDAP service (GitHub Advisory).

• Network: Repeated POST requests to /?controller=AuthController&action=check with unusual username field values such as *, admin*, a*, or other wildcard/prefix patterns from a single or rotating source IP.
• Logs (LDAP Server): LDAP search log entries showing filters like filter="(uid=*)", filter="(uid=admin*)", or other wildcard-based filters originating from the Kanboard application's bind DN, especially in rapid succession.
• Logs (Kanboard/Web Server): HTTP access logs showing multiple failed login attempts (HTTP 200 responses to the auth check endpoint) with short intervals and varying username values containing special characters (*, (, )).
• Behavioral: A sudden spike in LDAP search operations from the Kanboard server to the LDAP directory server, particularly searches returning large result sets (GitHub Advisory).

Upgrade Kanboard to version 1.2.49 or later, which fixes the vulnerability by replacing str_replace('%s', $username, $filter) with ldap_escape($username, '', LDAP_ESCAPE_FILTER) before substitution in both getLdapUserPattern() and getLdapGroupPattern(). No configuration-based workaround is available for the injection itself; however, restricting network access to the Kanboard login page and enabling LDAP server-side access controls can reduce exposure. Organizations should also review LDAP server logs for signs of prior exploitation (Patch Commit, Release Notes).

Heise (a major German IT news outlet) covered the vulnerability, noting it allows login as any user under certain conditions (Heise). BeyondMachines reported on Kanboard patching critical authentication bypass and information disclosure flaws (BeyondMachines). Community reaction on the GitHub release was positive, with multiple users reacting with thumbs up and hooray emojis to the v1.2.49 release that addressed the issue (Release Notes).