PT-2026-45722 · Yandex · Yandex Database

CVE-2026-10549 · Published 2026-06-02 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/AU:Y

Name of the Vulnerable Software and Affected Versions Yandex Database versions prior to 25.3.1.25

Description An LDAP filter injection allows a remote attacker with valid LDAP credentials to bypass group membership checks, which results in unauthorized access to the database. LDAP filter injection occurs when an application fails to properly sanitize user-supplied input used to construct an LDAP query, allowing an attacker to alter the query logic.

Recommendations Update to version 25.3.1.25.

Fix

LPE

Weakness Enumeration

CWE-280

Related Identifiers

CVE-2026-10549

Affected Products

Yandex Database

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-10549 · Security Note
• https://twitter.com/VulmonFeeds/status/2061815955097845929 · Twitter Post
• https://ydb.tech/docs/ru/security-changelog · Note
• https://t.me/CVEtracker/55588 · Telegram Post