Description

A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling user-existence oracle attacks at the referral Directory Name (DN). This could also potentially influence which DN is used for password binding in multi-domain Active Directory environments.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-08-14T23:16:34.093Z",
  "pubdate": "2026-08-14T23:16:34.093Z",
  "executiveSummary": "A vulnerability has been identified in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling mechanism. The flaw specifically resides in the inadequate escaping of user input when processing LDAP referrals returned during the authentication phase.\nThis vulnerability allows an unauthenticated or authenticated attacker to inject malicious LDAP filter metacharacters into the authentication request. Successful exploitation enables user-existence oracle attacks against the targeted referral Directory Name (DN) and introduces the potential to manipulate the specific DN selected for password binding in complex multi-domain Active Directory environments.\nThe primary risk associated with this vulnerability is the compromise of user account privacy through enumeration and potential domain authentication redirection. Attackers do not require elevated privileges to execute the attack, though exploitation relies on the system receiving and processing an LDAP referral containing the injected parameters.\nMitigation requires applying vendor-supplied patches or updates once available, as well as hardening external LDAP and Active Directory integration settings where applicable.",
  "technicalDetails": "The vulnerability stems from improper input sanitization and context-aware escaping within Red Hat Quay's LDAP authentication module. Specifically, when the application interacts with an external LDAP server and processes an LDAP referral response, the supplied username parameter is improperly handled before being concatenated into subsequent query structures.\nThe root cause is the absence of rigorous neutralization of LDAP filter metacharacters, such as parentheses, asterisks, and logical operators, within the input path leading to the referral handling routines. This allows an attacker to supply specially crafted input strings designed to alter the logical evaluation of the LDAP query executed against the referral Directory Name (DN).\nThe attack flow proceeds as follows: First, the attacker initiates an authentication attempt against Red Hat Quay using a specially crafted username containing LDAP filter metacharacters. Second, the external LDAP server responds with a referral directing the client to a different Distinguished Name or server domain. Third, Quay processes this referral by incorporating the attacker-controlled username without proper sanitization into the subsequent query. Fourth, the injected metacharacters manipulate the resulting filter logic, enabling the attacker to infer the existence of specific user accounts through response timing or error differentials (user-existence oracle attack). Furthermore, in multi-domain Active Directory configurations, this manipulation can influence or redirect the target DN utilized for the final password binding operation.\nThe vulnerable component is the external Lightweight Directory Access Protocol (LDAP) authentication handling subsystem within Red Hat Quay. Network exposure is dependent on the accessibility of the Red Hat Quay authentication interface. Authentication and privilege requirements for the initial trigger are minimal, as the injection occurs during the authentication process itself."
}