LDAP Injection in Moonraker Web Server Enables Information Disclosure

Publication date: 2026-01-22

Last updated on: 2026-02-27

Assigner: GitHub, Inc.

Description

Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. This issue has been fixed in version 0.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-22

Last Modified

2026-02-27

Generated

2026-07-07

AI Q&A

2026-01-23

EPSS Evaluated

2026-07-05

NVD

CVE-2026-24130

Affected Vendors & Products

Vendor	Product	Version / Range
arksine	moonraker	to 0.10.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-90	The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Moonraker versions 0.9.3 and below when the "ldap" component is enabled. It allows LDAP search filter injection via the login endpoint. An attacker can use the 401 error response message to determine if an LDAP search was successful, enabling brute force methods to discover LDAP entries such as user IDs and user attributes.

Impact Analysis

The vulnerability can allow an attacker to enumerate LDAP entries on the server, potentially exposing sensitive information like user IDs and attributes. This could lead to unauthorized information disclosure and facilitate further attacks against the system or its users.

Mitigation Strategies

Upgrade Moonraker to version 0.10.0 or later, as this version contains the fix for the LDAP search filter injection vulnerability.

Hi! I’m here to help you understand CVE-2026-24130. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70