Vulnerability · critical · CVSS 9.1
CVE-2026-129349: Apache Shiro LDAP realm accepts any password when caching is enabled
Tier A · Patch today – Before you go home
Who’s exposed: Applications using Apache Shiro DefaultLdapRealm with authentication caching enabled
Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover
Reach
Attack
Damage
Fix
Popular tool · Remote, no login · Full takeover
What to do
- Upgrade org.apache.shiro:shiro-core to 3.0.1 or later
- Review whether DefaultLdapRealm authentication caching is enabled in your application
The Brief
- CVE-2026-129349 affects Apache Shiro's DefaultLdapRealm when authentication caching is enabled.
- The source reports that the realm accepts any password in this configuration.
- Affected versions are shiro-core before 3.0.1, and the source rates the issue CVSS 4.0 9.1 (critical).
Why it matters
Applications using Shiro's LDAP realm with authentication caching may let attackers log in with any password, bypassing authentication entirely.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Shiro is a Java security framework that developers build with and run. |
| No | Core infrastructure | Judgment: a single framework, not software nearly every team runs like OpenSSH or GitHub. |
| Yes | Popular tool | Judgment: Shiro is a widely used Java framework across many teams. |
| No | Exploited in the wild | Open Source Security post reports no observed attacks; only the advisory is described. |
| No | Public exploit | Open Source Security post describes an advisory only; no exploit code or PoC is mentioned. |
| Yes | Remote, no login | Open Source Security: CVSS vector AV:N/PR:N/UI:N, network attack with no privileges or user interaction. |
| Yes | Full takeover | Open Source Security: realm accepts any password, enabling account takeover; CVSS VC:H/VI:H. |
| No | Secrets exposed | Open Source Security reports an authentication flaw; no credential or data theft is mentioned. |
| No | Supply chain | Open Source Security reports a normal authentication bug in legitimate code, not malicious shipped code. |
| No | No fix yet | Open Source Security: affected versions are before 3.0.1, so a fixed version exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability posted to the oss-sec mailing list by Lenny Primak
Open Source Security
CVE-2026-129349: Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled
Source
CVE-2026-129349: Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided