Snipe-IT: LDAP StartTLS downgrade via ignored return value
Summary
Snipe-IT ignores the return value of the StartTLS negotiation when connecting to an LDAP server. If StartTLS fails, the application still sends the bind credentials in cleartext. An attacker on the network path between Snipe-IT and the directory server can answer the StartTLS request with a protocol error and capture the LDAP service-account credentials and end-user passwords. The attack requires LDAP authentication with TLS enabled and a network position between the two systems.
Affected
- Snipe-IT up to and including 8.6.2 (GitHub advisory GHSA-wx48-r3qh-jvh5)
- The CNA record lists all versions before 8.6.3; the exact range of older releases is not fully confirmed.
Fixed in
- Snipe-IT 8.6.3 and later (fix in commit 91ea06904f)
Workaround
- No vendor workaround known.
- Interim measure, not confirmed by the vendor: connect to the directory server via LDAPS on port 636 instead of StartTLS, and restrict LDAP traffic to trusted network segments.
Exploitation
- No exploitation reported.
- Not listed in CISA KEV.
- No public proof of concept known.
Our recommendation
- Identify all Snipe-IT instances below 8.6.3 and upgrade to 8.6.3 or later.
- Check whether LDAP login or LDAP sync is enabled and how the TLS connection is configured.
- Close untrusted network segments between Snipe-IT and the directory server.
- Rotate the LDAP service-account password if exposure is suspected.
- Read the GitHub advisory directly to confirm the affected range.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-wx48-r3qh-jvh5 github.com
- VulnCheck advisory: Snipe-IT before 8.6.3 LDAP StartTLS Downgrade www.vulncheck.com
- OpenCVE: CVE-2026-116200 app.opencve.io
- VulDB entry 426254 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:01.
Original description (NVD)
Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a protocol error to capture service-account credentials and end-user login passwords.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.