CVE-2026-24130

Moonraker with LDAP Enabled Allows Malicious Search Filter Injection

State: Published
Severity: 2.7 Low
Published: Jan 22, 2026
Updated: Jan 23, 2026
Reserved: Jan 21, 2026

Description

Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. This issue has been fixed in version 0.10.0.

Scores

CVSS	Score	Vector	Source
4.0	2.7 Low	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U	GitHub_M

Weaknesses

CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-209 Generation of Error Message Containing Sensitive Information

Affected Products

Product	Versions
moonrakerArksine	< 0.10.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.