Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of public key authentication. Other Apache MINA SSHD servers are not affected. Lack of escaping LDAP filter metacharacters enabled successful authentication with username "*" and password "*". Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue by properly escaping filter parameters according to RFC 4515.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4622-1 advisory.

    - CVE-2026-77185: Asynchronous authentication can bypass signature verification (bsc#1283357).
    - CVE-2026-93994: Repeated-publickey policy bypass on server (bsc#1283352).
    - CVE-2026-93995: Remote execution of JGit 'archive -o=file.zip' can write file on the server     (bsc#1283350).
    - CVE-2026-93996: Memory exhaustion DoS via unbounded SCP command line read (bsc#1283348).
    - CVE-2026-94002: Memory exhaustion in SFTP client via unsolicited SFTP replies (bsc#1283347).
    - CVE-2026-94029: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension (bsc#1283346).
    - CVE-2026-94052: LDAP password authentication ineffective (bsc#1283345).
    - CVE-2026-94053: LDAP injection in sshd-ldap (bsc#1283344).

    Changes for apache-sshd:

    - Update to upstream version 2.20.0:
     + GH-656 ChannelPipedInputStream: shrink buffer when emptied      + GH-906 Fix finding a signature factory for BC ed25519 keys      + GH-911 Fix server-side SOCKS5 proxy for fragmented and      pipelined CONNECT requests      + Allow asynchronous authentication only for password and      keyboard-interactive authentication schemes      + Fix authentication requiring multiple public keys      (server-side)      + Better argument handling in sshd-git      + More checks in authentication (server-side)      + Better SCP command handling      + SFTP client: simplify response message handling      + Fix check-file-name/check-file-handle SFTP v6 extension      + Improve LDAP authentication (sshd-ldap)
     * New Features      + GH-905 Implement the 'from' and 'expiry-time' options in      authorized_keys handling in public key authentication (server      side)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to     2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.
    The optional sshd-ldap component provides support for integrating password and publickey authentication on     the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with     Apache MINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of     public key authentication. Other Apache MINA SSHD servers are not affected. Lack of escaping LDAP filter     metacharacters enabled successful authentication with username * and password *. Users are recommended     to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue by properly escaping     filter parameters according to RFC 4515. (CVE-2026-94053)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365326	SUSE SLED15 / SLES15 Security Update : apache-sshd (SUSE-SU-2026:4622-1)	Nessus	SuSE Local Security Checks	Local	critical
351261	Linux Distros Unpatched Vulnerability : CVE-2026-94053	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-94053

critical

Tenable Plugins

critical

critical