CVE-2026-24130
Moonraker affected by LDAP search filter injection
Impact
### Impact Instances of Moonraker configured with the `ldap` component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. ### Patches Users should upgrade to Moonraker 0.10.0 which patches this vulnerability. ### Workarounds Admins can set the `max_login_attempts` option in the `[authorization]` section to a reasonable value. Any IP attempting to exploit this vulnerability will be locked out after it has reached the specified number of consecutive failed login attempts. This condition is cleared after a Moonraker restart. Note that if an attacker knows a valid user password they can bypass this protection by successfully logging in. The most secure workaround for users unable to upgrade is to remove the `ldap` section from `moonraker.conf` and rely on the built in user authentication.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | moonraker | < 0.10.0 | 0.10.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Arksine | Moonraker | before 0.10.0 |