Netatalk LDAP Password Exposure Vulnerability in Log Output

A vulnerability in Netatalk versions 2.1.0 through 4.4.2 allows for the exposure of LDAP simple-bind passwords in the log output. This occurs when a bind failure is logged, potentially revealing sensitive authentication information to users or systems with access to the Netatalk logs. The issue arises during normal LDAP outages or restarts, where service account credentials can be inadvertently disclosed.

Impact

Exposing LDAP simple-bind passwords in the log files can lead to unauthorized access using the exposed credentials, particularly during periods of LDAP service disruption.

Remediation

Users can upgrade to Netatalk version 4.4.3 or later, which addresses this vulnerability. Alternatively, the patch available as 'CVE-2026-44052.patch' can be applied to a Netatalk 4.4.2 source tree.