{"id":"CVE-2026-24130","aliases":["GHSA-3jqf-v4mv-747g","PYSEC-2026-1679"],"title":"Moonraker affected by LDAP search filter injection","summary":"Moonraker affected by LDAP search filter injection","severity":"low","vendor":"moonraker","product":"moonraker","ecosystem":"pip","affected":["moonraker < 0.10.0"],"patched":["moonraker 0.10.0"],"published":"2026-01-22","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-3jqf-v4mv-747g","references":[{"url":"https://github.com/Arksine/moonraker/security/advisories/GHSA-3jqf-v4mv-747g"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24130"},{"url":"https://github.com/Arksine/moonraker/commit/74c5d8e44c4a4abbfbb06fb991e7ebb9ac947f42"},{"url":"https://github.com/Arksine/moonraker"}],"tags":["osv","pip"],"epss":0.00306,"epssPercentile":0.23624,"ingestedAt":"2026-07-08T18:25:44.931Z","slug":"CVE-2026-24130","body":"## Overview\n\n### Impact\n\nInstances of Moonraker configured with the `ldap` component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint.   The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes.\n\n### Patches\n\nUsers should upgrade to Moonraker 0.10.0 which patches this vulnerability.\n\n### Workarounds\n\nAdmins can set the `max_login_attempts` option in the `[authorization]` section to a reasonable value.    Any IP attempting to exploit this vulnerability will be locked out after it has reached the specified number of consecutive failed login attempts.  This condition is cleared after a Moonraker restart.   Note that if an attacker knows a valid user password they can bypass this protection by successfully logging in.\n\nThe most secure workaround for users unable to upgrade is to remove the `ldap` section from `moonraker.conf` and rely on the built in user authentication.\n\n## Affected packages\n\n- `moonraker < 0.10.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `moonraker 0.10.0`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}