CVE-2026-24130
📋 TL;DR
Moonraker versions 0.9.3 and below with LDAP enabled are vulnerable to LDAP injection attacks through the login endpoint. Attackers can use error messages to brute-force LDAP entries and discover user IDs and attributes. This affects systems using Moonraker's LDAP authentication component.
💻 Affected Systems
- Moonraker
📦 What is this software?
Moonraker by Arksine
⚠️ Risk & Real-World Impact
Worst Case
Attackers could enumerate all LDAP user accounts and attributes, potentially leading to credential harvesting and unauthorized access to the 3D printing system.
Likely Case
LDAP directory enumeration allowing discovery of valid usernames and user attributes for targeted attacks.
If Mitigated
Limited information disclosure if LDAP directory contains minimal sensitive data.
🎯 Exploit Status
Exploitation requires LDAP to be enabled and uses standard LDAP injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.10.0
Vendor Advisory: https://github.com/Arksine/moonraker/security/advisories/GHSA-3jqf-v4mv-747g
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Moonraker to version 0.10.0 or later. 3. Restart Moonraker service. 4. Verify LDAP authentication still works correctly.
🔧 Temporary Workarounds
Disable LDAP Authentication
allTemporarily disable LDAP authentication until patching is possible
Edit moonraker.conf and set 'enable_ldap: false' or remove LDAP configuration section
🧯 If You Can't Patch
- Disable LDAP authentication in Moonraker configuration
- Restrict network access to Moonraker API endpoints
🔍 How to Verify
Check if Vulnerable:
Check Moonraker version with 'python -m moonraker --version' and verify LDAP is enabled in configurationCheck Version:
python -m moonraker --versionVerify Fix Applied:
Confirm version is 0.10.0 or higher and test LDAP authentication functionality📡 Detection & Monitoring
Log Indicators:
- Multiple 401 errors with varying LDAP filter patterns
- Unusual LDAP query patterns in authentication logs
Network Indicators:
- Repeated POST requests to /access/login with varying parameters
- LDAP injection patterns in HTTP requests
SIEM Query:
source="moonraker.log" AND "401" AND "login" AND ("LDAP" OR "filter")