CVE-2026-95811: LemonLDAP::NG Access Rule Bypass — Detection and Remediation Guide for Debian LTS

Debian has issued DLA-4797-1, a Long Term Support security update for lemonldap-ng, the widely deployed open-source Web-SSO and access management platform (LemonLDAP::NG). The update addresses CVE-2026-95811, an access-control bypass vulnerability rooted in a classic but dangerous discrepancy: the handler evaluated locationRules against the raw request URI, while front-end web servers (Nginx, Apache) route requests based on the decoded and normalized path.

The consequence is straightforward and severe: access rules protecting the administrative (Manager) interface — or any protected location — can be bypassed by an unauthenticated remote attacker who crafts a request whose raw URI does not match the rule, but whose decoded path routes to the protected resource. In environments where LemonLDAP::NG guards internal applications, HR portals, or admin consoles, this flaw collapses the enforcement layer that security teams believe is standing between the internet and those assets.

If you run LemonLDAP::NG on Debian LTS (bullseye) as an identity portal or reverse-proxy handler, treat this as a priority patch. SSO infrastructure is, by design, internet-facing and identity-bearing — it is exactly the class of target nation-state and criminal operators hunt first.

Technical Analysis

Affected Products and Platforms

• Product: lemonldap-ng (LemonLDAP::NG) — Perl-based Web-SSO system providing portal, handler, and manager components
• Platform: Debian GNU/Linux LTS (bullseye era packages), addressed via DLA-4797-1
• Affected component: The access handler's locationRules evaluation engine
• Upstream severity context: This is an improper-input-validation / inconsistent-interpretation class flaw (path canonicalization mismatch, CWE-436 family). No CVSS score has been published in the Debian advisory text; based on exploitability (remote, unauthenticated, low complexity) and impact (security control bypass on administrative interfaces), practitioners should treat it as high severity until a formal score is released.

How the Vulnerability Works

LemonLDAP::NG handlers sit in front of applications and enforce access decisions using locationRules — regex-based rules keyed to URL paths (e.g., deny everyone except specific IPs for the Manager virtual host, or require a specific group for /admin).

The flaw in CVE-2026-95811:

1. The handler reads the request and matches it against locationRules using the raw, undecoded URI as sent on the wire.
2. The web server (Nginx location matching, Apache mod_proxy/mod_perl routing) makes its routing decision on the decoded, normalized path — percent-encoding resolved, dot segments collapsed, duplicate slashes merged.
3. An attacker submits a request whose raw form (e.g., containing %2e, %2f, mixed-case encodings, or double-encoded sequences) fails to match the restrictive rule, but decodes/normalizes server-side into the exact protected path.

Result: the enforcement decision and the routing decision disagree, and the request reaches the protected resource — including Manager (admin) interface locations — without the intended access rule ever firing. This is the same architectural failure pattern seen in past reverse-proxy and WAF bypass incidents across the industry: two parsers, one decision path, and an attacker who controls the input both parsers see differently.

Exploitation requirements are minimal: network reachability to the portal/manager virtual host and knowledge of URL-encoding techniques. No authentication, no special tooling, no race conditions.

Exploitation Status

• Public disclosure: Debian LTS advisory DLA-4797-1 (2026)
• In-the-wild exploitation: Not confirmed in the advisory text at time of writing
• CISA KEV: Not listed at time of writing
• PoC availability: None publicly confirmed — however, the bypass technique (encoding/normalization tricks against path-based ACLs) is textbook material and trivially reconstructible from the advisory description alone. Assume skilled adversaries are already probing internet-facing LemonLDAP::NG manager portals.

Given how quickly SSO and IdM vulnerabilities have been weaponized in 2025–2026, defenders should operate on the assumption of imminent scanning activity against exposed manager interfaces.

Detection & Response

The most reliable detection surface is web server access logs (Nginx/Apache) and any upstream WAF/reverse-proxy telemetry: you are looking for requests containing percent-encoded or double-encoded sequences that resolve to protected LemonLDAP::NG locations (the Manager interface, typically manager.html and its API endpoints, or any path you protect with locationRules).

SIGMA Rules

---
title: LemonLDAP-NG Manager Access via Encoded URI (CVE-2026-95811)
id: 8f2c1a4d-7b93-4e21-b6a5-0d3e9f47c2b1
status: experimental
description: Detects requests to the LemonLDAP::NG Manager interface where the raw URI contains percent-encoded or double-encoded characters, consistent with locationRules access-control bypass attempts (CVE-2026-95811).
references:
  - https://linuxsecurity.com/advisories/deblts/debian-dla-4797-1-lemonldap-ng
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_manager:
    cs-uri|contains:
      - 'manager'
  selection_encoded:
    cs-uri|contains:
      - '%2e'
      - '%2f'
      - '%5c'
      - '%25'
      - '%3f'
      - '%00'
  condition: selection_manager and selection_encoded
falsepositives:
  - Legitimate queries with encoded parameters in search strings
level: high
---
title: Encoded Path Traversal Sequences Against SSO Protected Locations
id: 3d91e7b2-5c48-4f06-a1d9-2b8c4e60a915
status: experimental
description: Detects raw URIs containing encoded dot-segments or slashes targeting any path, a generic normalization-mismatch indicator relevant to CVE-2026-95811 exploitation against LemonLDAP::NG locationRules.
references:
  - https://linuxsecurity.com/advisories/deblts/debian-dla-4797-1-lemonldap-ng
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains:
      - '%2e%2e'
      - '%2e%2f'
      - '%2f%2e'
      - '..%2f'
      - '%252e'
      - '%252f'
  condition: selection
falsepositives:
  - Rare legacy application behavior; review per-application
level: medium

KQL (Microsoft Sentinel)

Hunt web/proxy telemetry ingested via CEF or Syslog for encoded requests hitting LemonLDAP::NG manager paths, and baseline source IPs making repeated attempts:

// CVE-2026-95811: encoded-URI attempts against LemonLDAP::NG manager interface
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("manager", "lmAuth", "mail")
| where RequestURL has_any ("%2e", "%2f", "%5c", "%25", "%00", "..%2f", "%252e")
| extend DecodedHint = url_decode(RequestURL)
| summarize AttemptCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), SampleURIs = make_set(RequestURL, 10) by SourceIP, DestinationHostName
| order by AttemptCount desc

// Fallback: syslog-ingested Nginx/Apache access logs from LemonLDAP::NG hosts
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("%2e", "%2f", "%252e", "%252f")
| where SyslogMessage has_any ("manager", "GET", "POST")
| project TimeGenerated, Computer, SyslogMessage
| order by TimeGenerated desc

Velociraptor VQL

Use this artifact on LemonLDAP::NG servers to sweep web access logs for encoded requests reaching manager locations — useful for retro-hunting compromise before the patch date:

-- Hunt Nginx/Apache access logs for encoded URI bypass attempts against manager paths (CVE-2026-95811)
LET logs = SELECT FullPath FROM glob(globs=['/var/log/nginx/*access*.log*', '/var/log/apache2/*access*.log*'])
SELECT FullPath, Line, timestamp(string=Line) AS ApproxTime
FROM foreach(row=logs,
query={
    SELECT FullPath, Line
    FROM parse_lines(filename=FullPath)
    WHERE Line =~ '(?i)manager'
      AND Line =~ '(%2e|%2f|%5c|%252e|%252f|%00|\.\.%2f)'
})
ORDER BY FullPath

Remediation Script (Bash)

Run on Debian LTS hosts hosting the LemonLDAP::NG portal/handler/manager:

#!/bin/bash
# CVE-2026-95811 / DLA-4797-1 — LemonLDAP::NG access rule bypass remediation & verification
set -e

echo "[1] Checking installed lemonldap-ng version..."
dpkg -l | grep -i lemonldap || { echo "lemonldap-ng not installed on this host."; exit 0; }

echo "[2] Refreshing package indexes and applying the DLA-4797-1 update..."
apt-get update
apt-get install --only-upgrade -y lemonldap-ng liblemonldap-ng-portal-perl liblemonldap-ng-handler-perl liblemonldap-ng-manager-perl 2>/dev/null || apt-get install --only-upgrade -y lemonldap-ng

echo "[3] Verifying patched package version..."
dpkg -l | grep -i lemonldap

echo "[4] Restarting dependent services..."
systemctl restart nginx 2>/dev/null || systemctl restart apache2 2>/dev/null || true

echo "[5] Quick config sanity check — review locationRules for the Manager vhost:"
grep -rni "locationrules\|manager" /etc/lemonldap-ng/ 2>/dev/null | head -20 || echo "Review /etc/lemonldap-ng/lemonldap-ng.ini manually."

echo "[6] Hunt for pre-patch bypass attempts in web logs:"
grep -Ei 'manager.*(%2e|%2f|%5c|%252e|%252f)|(%2e|%2f|%252e).*manager' /var/log/nginx/*access*.log /var/log/apache2/*access*.log 2>/dev/null | tail -50 || echo "No suspicious encoded requests found."

echo "Done. Confirm portal and manager functionality post-restart."

Remediation

1. Patch immediately. Apply DLA-4797-1 via apt-get update && apt-get upgrade (or the targeted upgrade shown above) on all Debian LTS hosts running lemonldap-ng packages — handler nodes, portal nodes, and manager nodes. Reference: Debian DLA-4797-1 advisory.
2. Retro-hunt before you assume you're clean. Because the bypass is silent at the application layer, review access logs for encoded URIs hitting manager/protected paths over at least the past 30 days. Successful bypass attempts will show HTTP 200 responses on encoded manager requests from untrusted sources.
3. Restrict Manager interface exposure as defense-in-depth. Even post-patch, the Manager (admin) virtual host should never be broadly internet-reachable. Enforce IP allowlisting or place it behind a VPN/ZTNA gateway at the web-server or network layer — an enforcement point below LemonLDAP::NG's rule engine, so a future handler-level discrepancy cannot silently bypass it.
4. Audit your locationRules. Inventory every locationRule protecting administrative or sensitive paths. Where feasible, move critical enforcement (authentication of the admin interface, mutual TLS, source-IP restrictions) to the web server configuration itself (allow/deny in Nginx/Apache) rather than relying solely on the SSO handler.
5. Rotate credentials if compromise is suspected. If retro-hunting shows encoded manager requests that returned 2xx from external IPs before patching, treat the SSO administrator credentials and session signing material as potentially exposed: rotate manager admin passwords, invalidate active sessions, and review configuration changes (new virtual hosts, modified rules, added users) in the Manager audit trail.
6. Watch for upstream updates. Monitor the LemonLDAP::NG project (lemonldap-ng.org) and the Debian LTS security tracker for follow-on fixes — normalization bugs often come in families, and adjacent decoding edge cases may surface.

The broader lesson for defenders: any access control evaluated on a different representation of input than the one used for routing is an access control waiting to be bypassed. Inventory every place in your stack — WAFs, reverse proxies, SSO handlers, application ACLs — where a parsing discrepancy can split the decision from the action, and test each layer with encoded, double-encoded, and mixed-encoding probes. Penetration testing engagements should explicitly include normalization-bypass cases against SSO-protected paths.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub