Zero Radar
← feed
CriticalVulnerabilityCVE-2026-58256updated 27 Oct 2026, 23:17 UTC

GRR resource booking app: admin can run malicious code via LDAP settings

An administrator of the GRR room and resource booking app can plant malicious code in the LDAP login settings, which can then run on the server. The attack depends on the admin first connecting to an LDAP server that the attacker controls.

Fixed in GRR 4.5.0Official source
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesGRR 4.5.0 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker-run LDAP serverAdmin is directed to a malicious server
  2. 2Admin connects to LDAPConnection succeeds on the GRR settings page
  3. 3Malicious filter submittedAdmin enters PHP code in ldap_filter
  4. 4Config file poisonedconfig_ldap.inc.php now contains attacker PHP
  5. 5Code executes on serverRuns when the config file is loaded
  6. ResultAttacker runs code on the GRR server

What happened

In GRR, prior to 4.5.0, LDAP connector parameters such as ldap_filter are not sanitized before being written into /personnalisation/config_ldap.inc.php, allowing injection of PHP that leads to remote code execution.

Why it is dangerous: Successful exploitation lets someone run arbitrary code on the GRR server, exposing its data and allowing takeover of the host. The main risk is to organizations hosting GRR with LDAP integration and multiple admin accounts.

Are you affected?

You are affected if you run GRR earlier than 4.5.0 with LDAP connector configuration enabled.

GRR versions prior to 4.5.0

What to do

  1. Update GRR to version 4.5.0 or later
  2. Review LDAP connector settings and the config_ldap.inc.php file for unexpected PHP code
  3. Limit administrator accounts to trusted staff

Timeline

  1. 27 Oct 2026, 23:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 23:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 23:17 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-58256
CVSS
9.1 / 10
EPSS
0.6% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 23:17 UTC
On Zero Radar
27 Oct 2026, 23:17 UTC (1 min after disclosure)
Last change
27 Oct 2026, 23:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

GRR resource booking app: admin can run malicious code via LDAP settings · Zero Radar