CVE-2026-103547
In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)
CVE-2026-103547
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-103547
OpenBSD
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/openbsd/src",
"vendor": "OpenBSD",
"product": "OpenBSD",
"versions": [
{
"status": "affected",
"version": "7.8",
"lessThan": "errata 057",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.9",
"lessThan": "errata 021",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-103547
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #4881 · Revision 1
- Added to Heist Feed
- Publisher date