GHSA-3jqf-v4mv-747g

Source

https://github.com/advisories/GHSA-3jqf-v4mv-747g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-3jqf-v4mv-747g/GHSA-3jqf-v4mv-747g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3jqf-v4mv-747g

Aliases

CVE-2026-24130

Published

2026-01-22T18:06:54Z

Modified

2026-02-03T03:08:57.082525Z

Severity

2.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Moonraker affected by LDAP search filter injection

Details

Impact

Instances of Moonraker configured with the ldap component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes.

Patches

Users should upgrade to Moonraker 0.10.0 which patches this vulnerability.

Workarounds

Admins can set the max_login_attempts option in the [authorization] section to a reasonable value. Any IP attempting to exploit this vulnerability will be locked out after it has reached the specified number of consecutive failed login attempts. This condition is cleared after a Moonraker restart. Note that if an attacker knows a valid user password they can bypass this protection by successfully logging in.

The most secure workaround for users unable to upgrade is to remove the ldap section from moonraker.conf and rely on the built in user authentication.

Database specific

{
    "github_reviewed": true,
    "severity": "LOW",
    "cwe_ids": [
        "CWE-90"
    ],
    "nvd_published_at": "2026-01-22T23:15:58Z",
    "github_reviewed_at": "2026-01-22T18:06:54Z"
}

References

Affected packages

PyPI / moonraker

Package

Name: moonraker; View open source insights on deps.dev
Purl: pkg:pypi/moonraker

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.10.0

Affected versions

0.*

0.8.0

0.9.0

0.9.1

0.9.2

0.9.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-3jqf-v4mv-747g/GHSA-3jqf-v4mv-747g.json"