← Database

CVE-2022-37397

HIGH CVSS: 8.3 Published: 2022-08-12 Modified: 2026-06-17

Description

An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.

Affected Platforms

Yugabyte Yugabytedb

Weakness Type

CWE-16, CWE-287, CWE-287

References