CVE-2026-103878
Received Received - Intake

Cleartext Transmission of Sensitive Data in Apache Directory LDAP API

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Apache Software Foundation

Description
Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API: from 2.1.0 before 2.1.9. Users are recommended to upgrade to version 2.1.9, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-103878
EUVD
EUVD-2026-91378

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache directory_ldap_api From 2.1.0 (inc) to 2.1.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the cleartext transmission of sensitive information in Apache Directory LDAP API. A StartTLS operation started after a Search request can cause data to be received in plain text before the TLS handshake completes, potentially exposing sensitive data.

Detection Guidance

This vulnerability involves cleartext transmission of sensitive data due to improper StartTLS operation timing. To detect it, monitor LDAP traffic for plaintext data before TLS handshake completion. Use network sniffing tools like tcpdump or Wireshark to capture LDAP packets and inspect for unencrypted sensitive information during the StartTLS process.

Impact Analysis

An attacker could intercept sensitive data transmitted before TLS encryption is fully established, leading to unauthorized access to credentials or other confidential information.

Compliance Impact

This vulnerability could violate compliance requirements for data protection (e.g., GDPR, HIPAA) by exposing sensitive data in transit, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Upgrade Apache Directory LDAP API to version 2.1.9 or later immediately. Disable StartTLS operations if not required. Review LDAP server configurations to ensure StartTLS is only initiated after proper TLS handshake completion. Monitor network traffic for unencrypted LDAP data transmission.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103878. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart