Description

Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 401 error response message can be used to determine whether or not a search was successful, allowing for brute force methods to discover LDAP entries on the server such as user IDs and user attributes. This issue has been fixed in version 0.10.0.

INFO

Published Date :

2026-01-22T22:53:34.769Z

Last Modified :

2026-01-23T20:03:49.510Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-24130 vulnerability.

Vendors Products
Arksine
  • Moonraker
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-24130.

URL Resource
https://github.com/Arksine/moonraker/commit/74c5d8e44c4a4abbfbb06fb991e7ebb9ac947f42 cve-icon cve-icon
https://github.com/Arksine/moonraker/security/advisories/GHSA-3jqf-v4mv-747g cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact