CVE-2026-58256

Received Received - Intake

Remote Code Execution in GRR via LDAP Connector

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-58256

Affected Vendors & Products

Vendor	Product	Version / Range
JeromeDevome	GRR	< 4.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in GRR allows an administrator to inject malicious PHP code through LDAP connector settings like ldap_filter. The malicious code is written to a configuration file, enabling remote code execution. The issue requires an attacker to first authenticate to an LDAP server and then submit crafted input on the connector settings page.

Detection Guidance

Check for unauthorized modifications to /personnalisation/config_ldap.inc.php or suspicious LDAP connector configurations. Review logs for unexpected PHP execution or LDAP filter changes.

Impact Analysis

An attacker exploiting this vulnerability could execute arbitrary code on the server running GRR. This may lead to full system compromise, data theft, or unauthorized access to sensitive information. The impact depends on the server's role and the data it handles.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using vulnerable GRR versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade GRR to version 4.5.0 or later. Restrict LDAP server access to trusted sources. Audit LDAP connector settings for malicious entries. Monitor for unauthorized PHP file changes.

Hi! I’m here to help you understand CVE-2026-58256. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70