Apache CXF LDAP injection flaw can expose arbitrary certificates from XKMS repositories

Apache CXF users should upgrade after a newly disclosed LDAP injection vulnerability was found in the XKMS LDAP certificate repository. The flaw, tracked as CVE-2026-44930, can let an attacker retrieve arbitrary certificates from a vulnerable repository.

The issue was disclosed through the Apache developer mailing list on May 22, 2026. Apache rated the vulnerability as Important and recommended upgrading to Apache CXF 4.2.1, 4.1.6, or 3.6.11.

The vulnerability affects organizations that use Apache CXF’s XKMS server with the LDAP certificate repository. It does not affect every CXF deployment by default, but it matters for environments that rely on XKMS to locate and manage certificates through LDAP-backed storage.

What CVE-2026-44930 allows

CVE-2026-44930 is an LDAP injection flaw in the LDAP certificate repository used by the XKMS server in Apache CXF. LDAP injection happens when user-controlled input is not properly neutralized before being used in an LDAP query.

The NVD entry for CVE-2026-44930 says the flaw may allow an attacker to retrieve arbitrary certificates from the repository. NVD also classifies the weakness as CWE-90, improper neutralization of special elements used in an LDAP query.

In practical terms, an attacker could manipulate a certificate lookup request so the backend LDAP query returns certificates outside the intended lookup scope. The advisory does not describe password theft or direct private key exposure, but arbitrary certificate retrieval can still weaken trust controls.

Item	Details
CVE	CVE-2026-44930
Product	Apache CXF
Affected component	XKMS LDAP certificate repository
Vulnerability type	LDAP injection
Impact	Retrieval of arbitrary certificates from the repository
Apache severity	Important
NVD CVSS 3.1 score	9.8 Critical

Why XKMS certificate repositories matter

XKMS stands for XML Key Management Specification. In Apache CXF, it can provide a SOAP-based interface for locating and validating certificates used by services and security components.

The Apache CXF XKMS documentation explains that the XKMS SOAP interface can act as a standard frontend to Public Key Infrastructure. It also notes that certificates can be searched in an LDAP repository through an LDAP lookup handler.

That makes the affected component security-sensitive. If attackers can retrieve certificates that should not be returned, they may gain useful information about users, services, internal naming, certificate chains, or trusted identities inside an enterprise environment.

Affected and fixed versions

The vulnerability affects Apache CXF versions before 3.6.11, versions from 4.0.0 through before 4.1.6, and version 4.2.0. Apache fixed the issue in 3.6.11, 4.1.6, and 4.2.1.

The Apache CXF download page lists 4.2.1, 4.1.6, and 3.6.11 as available releases. Administrators should upgrade to the fixed release that matches their deployed branch.

Teams should also check whether Apache CXF is embedded inside a larger product, application server, integration platform, or custom Java service. In many enterprise environments, CXF may be present as a dependency rather than a standalone installation.

Branch	Affected versions	Fixed version
3.x	Before 3.6.11	3.6.11
4.0 and 4.1	4.0.0 through before 4.1.6	4.1.6
4.2	4.2.0	4.2.1

Why this is not just a minor information leak

Certificates are public by design in many contexts, but repositories still enforce lookup rules for a reason. Certificate data can reveal service identities, internal hostnames, account naming patterns, trust relationships, and deployment structure.

That information can help attackers plan follow-up attacks. For example, certificate enumeration can support impersonation attempts, targeted phishing, service mapping, or discovery of internal systems that should not be visible externally.

Organizations using XKMS for certificate lifecycle workflows should treat this as a sensitive data exposure issue, especially if the XKMS service is reachable from untrusted networks or partner-facing systems.

• Review whether the XKMS server is enabled.
• Confirm whether the LDAP certificate repository is in use.
• Identify internet-facing or partner-facing XKMS endpoints.
• Check application dependencies for embedded Apache CXF versions.
• Upgrade to 4.2.1, 4.1.6, or 3.6.11.
• Review logs for unusual certificate lookup patterns.

What administrators should patch

Administrators should upgrade affected CXF deployments to the fixed version for their branch. Organizations on 4.2.0 should move to 4.2.1, 4.1.x users should move to 4.1.6, and 3.6.x users should move to 3.6.11.

The Apache CXF download page also notes that 3.6.11 is the last planned release for the 3.6.x line. Teams still using the 3.x branch should consider whether they need a longer-term migration plan, not only this emergency fix.

Before production rollout, teams should test certificate lookup and validation workflows. XKMS services can sit inside authentication, message security, and service-to-service trust paths, so patch testing should include real certificate lookup scenarios.

How attackers could use LDAP injection here

An attacker interacting with a vulnerable XKMS endpoint could submit crafted input that changes the LDAP search filter. Instead of returning only the intended certificate, the repository may return certificates that match the injected query logic.

The Apache mailing list disclosure keeps the description concise, but the risk centers on improper query handling in the LDAP certificate repository. The safest assumption is that untrusted lookup input should never directly shape LDAP filters without strict escaping and validation.

Security teams should avoid waiting for exploit code before patching. LDAP injection flaws are well understood, and attackers can often test vulnerable endpoints with crafted filters once enough implementation detail becomes public.

Risk area	Possible impact
Certificate enumeration	Attackers may retrieve certificates outside the intended scope
Service discovery	Certificate subjects and issuers may reveal internal systems
Trust mapping	Attackers may learn about certificate chains and trusted identities
Follow-up attacks	Retrieved certificate data may support impersonation or reconnaissance

Mitigation steps beyond upgrading

Patching is the primary fix, but organizations should also reduce exposure around XKMS and LDAP-backed certificate services. External access should be limited to trusted clients, and LDAP permissions should follow least privilege.

The Apache CXF XKMS documentation shows that XKMS can support multiple backend handlers, including LDAP and file-based repositories. Administrators should confirm which handlers are active and whether LDAP repositories expose more certificates than the application needs.

Security teams should also review logs for broad certificate searches, unusual lookup filters, repeated failed lookup attempts, and access from unexpected clients.

• Restrict XKMS endpoints to trusted networks and clients.
• Apply least-privilege access controls to the LDAP certificate repository.
• Validate and normalize certificate lookup inputs at service boundaries.
• Monitor LDAP query patterns for wildcard-heavy or unusual filters.
• Review returned certificate volumes for abnormal spikes.
• Rotate or review trust material if certificate exposure suggests broader misuse.

What to check in enterprise environments

Enterprise teams should not look only for standalone CXF services. Apache CXF may be bundled inside internal Java applications, SOAP services, integration middleware, or vendor-supplied products.

Software composition analysis, Maven dependency checks, container image scans, and SBOM reviews can help identify vulnerable CXF versions. Teams should also confirm whether the vulnerable XKMS LDAP repository classes are actually deployed and reachable.

The NVD record lists the affected version ranges and CVSS vector, but local risk depends heavily on whether XKMS LDAP certificate lookup is enabled and exposed.

1. Inventory applications using Apache CXF.
2. Check Maven, Gradle, container, and application server dependencies.
3. Identify any enabled XKMS services.
4. Confirm whether LDAP certificate repository support is active.
5. Upgrade affected CXF versions to a fixed release.
6. Test certificate lookup and validation workflows after patching.
7. Review access logs for abnormal certificate retrieval activity.

Bottom line

CVE-2026-44930 is an Apache CXF LDAP injection flaw affecting the XKMS LDAP certificate repository. It can allow attackers to retrieve arbitrary certificates, creating a reconnaissance and trust-infrastructure risk for affected deployments.

The fix is available in Apache CXF 4.2.1, 4.1.6, and 3.6.11. Organizations should patch quickly, restrict XKMS exposure, review LDAP repository access, and check logs for suspicious certificate lookup behavior.

This is not a confirmed remote code execution issue based on the Apache advisory. The main risk is unauthorized certificate retrieval, which can still support broader attacks when combined with exposed services, weak access controls, or poor certificate management.

FAQ