CVE-2026-90979

Apache Karaf is vulnerable to LDAP filter injection due to improper neutralization of special elements in the JAAS LDAP login modules . The LDAPCache and LDAPBackingEngine components build LDAP search filters by substituting placeholders (%u, %dn, %fqdn) into templates using Matcher.quoteReplacem...