title: The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory
description: An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.
problem types: CWE-287 Improper Authentication
affected:
{
platforms: macos, darwin
product: Yugabyte DB
vendor: YugaByte, Inc.
versions:
status: affected, version: 2.6.1.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
]
solutions: Upgrade to non-vulnerable version 2.6.1.1+
workarounds: Disable LDAP for YCQL.