Remote Code Execution Vulnerability in GRR by JeromeDevome
CVE-2026-58256

9.1CRITICAL

Key Information:

Vendor

Jeromedevome

Status
Grr
Vendor
CVE Published:
27 October 2026

What is CVE-2026-58256?

The GRR resource management application allows for remote code execution due to a vulnerability in its LDAP connector configuration. Prior to version 4.5.0, administrators could potentially inject malicious PHP code through parameters like ldap_filter. This situation arises when an administrator connects to a compromised LDAP server and submits harmful input on the connector settings page. The vulnerability allows attackers to manipulate system configuration, leading to significant risks. This issue was addressed in the released patch version 4.5.0.

Affected Version(s)

GRR < 4.5.0

References

https://github.com/JeromeDevome/GRR/security/advisories/G...
x_refsource_CONFIRM
https://github.com/JeromeDevome/GRR/commit/3ff9504ae557da...
x_refsource_MISC
https://github.com/JeromeDevome/GRR/tree/v4.5.0
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.