CVE-2026-116200
Received Received - Intake

LDAP Cleartext Credential Exposure in Snipe-IT

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116200
EUVD
EUVD-2026-109458

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
grokability snipe-it 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Snipe-IT before version 8.6.3 has a flaw in its LDAP authentication where it ignores the return value of the ldap_start_tls() function. This allows attackers on the network path to intercept and force a downgrade from encrypted LDAP (StartTLS) to plaintext LDAP by sending a protocol error during the TLS negotiation. As a result, credentials like service-account details and end-user passwords are transmitted in cleartext and can be captured.

Detection Guidance

To detect this vulnerability, monitor LDAP traffic for cleartext authentication attempts. Use Wireshark or tcpdump to capture LDAP packets and check for unencrypted binds. Inspect Snipe-IT logs for failed StartTLS negotiations or unexpected plaintext LDAP connections.

Impact Analysis

If you use Snipe-IT versions before 8.6.3 with LDAP authentication enabled and TLS configured, attackers on your network can steal login credentials during authentication. This includes both service-account credentials and end-user passwords, potentially leading to unauthorized access to systems and data.

Compliance Impact

This vulnerability violates requirements for encrypted transmission of sensitive data in standards like GDPR and HIPAA. Cleartext transmission of credentials and passwords risks non-compliance with data protection regulations, potentially leading to legal penalties and loss of trust.

Mitigation Strategies
  • Upgrade Snipe-IT to version 8.6.3 or later to fix the LDAP StartTLS handling issue.
  • Ensure LDAP authentication uses StartTLS properly and validate TLS negotiation success before proceeding with binds.
  • Monitor network traffic for LDAP downgrade attempts or cleartext credential transmissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116200. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart