CVE-2026-85981: unauth local panel leaks AD creds

CISO Take

The Auth0 AD/LDAP Connector (≤6.5.0) exposes its administrative panel on localhost without any authentication, letting any local user or process on the host read plaintext Active Directory service-account credentials and tamper with connector configuration. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template, and the CVSS vector's Privileges Required: High conflicts with the advisory's own description of a 'low-privileged' local actor — treat the practical bar to exploitation as uncertain until Okta clarifies, but the confidentiality/integrity/availability impact once triggered is severe (C:H/I:H/A:H) because it hands over the credentials that bridge the connector host to your Active Directory. This is not an AI/ML-specific flaw, but it matters wherever this connector sits in the identity chain that gates access to AI platforms, RAG data sources, or model-serving environments synced from AD. Patch to the fixed release from Okta's advisory, and in the meantime restrict local access to the connector host, audit which processes/users can reach the loopback admin port, and rotate the AD service account credentials it manages.

Sources: NVD trust.okta.com ATLAS

What is the risk?

Medium severity (CVSS 6.7) driven by high confidentiality/integrity/availability impact but constrained by the local attack vector. There is a real inconsistency in the disclosed data: the advisory text describes exploitation by a 'low-privileged user or process,' while the CVSS vector specifies Privileges Required: High — this should be clarified before assuming either a trivial or a hard-to-reach exploitation bar. No EPSS score, no CISA KEV entry, no public PoC or scanner template exists, so there's no evidence of active or imminent mass exploitation. The realistic risk driver is any multi-tenant host, shared jump box, or compromised low-privilege foothold where an attacker (or malicious insider) can reach loopback services — from there, credential theft is immediate and requires no further exploitation skill.

How does the attack unfold?

Local foothold

Attacker obtains a local low-privilege session or process execution on the host running the Auth0 AD/LDAP Connector.

Unauthenticated panel access

Attacker connects to the connector's admin panel on the loopback interface, which requires no credentials to reach.

AML.T0055

Credential theft

Attacker reads the plaintext Active Directory service account credentials from the exposed configuration.

AML.T0055

Directory pivot / impact

Attacker authenticates to Active Directory (or downstream trusting systems) as the stolen service account, or modifies connector settings to disrupt authentication flows.

AML.T0012

Local foothold

Attacker obtains a local low-privilege session or process execution on the host running the Auth0 AD/LDAP Connector.

Unauthenticated panel access

Attacker connects to the connector's admin panel on the loopback interface, which requires no credentials to reach.

AML.T0055

Credential theft

Attacker reads the plaintext Active Directory service account credentials from the exposed configuration.

AML.T0055

Directory pivot / impact

Attacker authenticates to Active Directory (or downstream trusting systems) as the stolen service account, or modifies connector settings to disrupt authentication flows.

AML.T0012

How severe is it?

CVSS 3.1

6.7 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 2% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Local

AC Low

PR High

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Patch the Auth0 AD/LDAP Connector to the version specified in Okta's advisory (beyond 6.5.0) as soon as it's available. 2) Until patched, restrict which local users/processes can reach the loopback admin port (host firewall rules, process isolation, minimize shared access to the connector host). 3) Treat the AD service account credentials configured in the connector as potentially exposed — rotate them and review AD audit logs for anomalous activity from that account. 4) Harden host access controls generally (this is a local-vector bug, so reducing the population of local users/processes with any foothold on the connector host is the primary compensating control). 5) Monitor connector configuration for unauthorized changes as a detection signal.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Plugin AML.T0012 - Valid Accounts AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

GOVERN-6.1 - Policies and procedures for third-party AI system risks

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-85981?

The Auth0 AD/LDAP Connector (≤6.5.0) exposes its administrative panel on localhost without any authentication, letting any local user or process on the host read plaintext Active Directory service-account credentials and tamper with connector configuration. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template, and the CVSS vector's Privileges Required: High conflicts with the advisory's own description of a 'low-privileged' local actor — treat the practical bar to exploitation as uncertain until Okta clarifies, but the confidentiality/integrity/availability impact once triggered is severe (C:H/I:H/A:H) because it hands over the credentials that bridge the connector host to your Active Directory. This is not an AI/ML-specific flaw, but it matters wherever this connector sits in the identity chain that gates access to AI platforms, RAG data sources, or model-serving environments synced from AD. Patch to the fixed release from Okta's advisory, and in the meantime restrict local access to the connector host, audit which processes/users can reach the loopback admin port, and rotate the AD service account credentials it manages.

Is CVE-2026-85981 actively exploited?

No confirmed active exploitation of CVE-2026-85981 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-85981?

1) Patch the Auth0 AD/LDAP Connector to the version specified in Okta's advisory (beyond 6.5.0) as soon as it's available. 2) Until patched, restrict which local users/processes can reach the loopback admin port (host firewall rules, process isolation, minimize shared access to the connector host). 3) Treat the AD service account credentials configured in the connector as potentially exposed — rotate them and review AD audit logs for anomalous activity from that account. 4) Harden host access controls generally (this is a local-vector bug, so reducing the population of local users/processes with any foothold on the connector host is the primary compensating control). 5) Monitor connector configuration for unauthorized changes as a detection signal.

What systems are affected by CVE-2026-85981?

This vulnerability affects the following AI/ML architecture patterns: Identity and access management layer for AI platforms, RAG pipelines relying on AD-gated document access.

What is the CVSS score for CVE-2026-85981?

CVE-2026-85981 has a CVSS v3.1 base score of 6.7 (MEDIUM). The EPSS exploitation probability is 0.12%.

What is the AI security impact?

Affected AI Architectures

Identity and access management layer for AI platformsRAG pipelines relying on AD-gated document access

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0055 Unsecured Credentials

Compliance Controls Affected

NIST AI RMF: GOVERN-6.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Through these endpoints, a local user can read configuration details, including plaintext Active Directory service account credentials, and modify connector settings.

Exploitation Scenario

An attacker who has already obtained some form of local foothold on the connector host — via a separate vulnerability, a compromised low-privilege service account, or malicious code running as another local process — connects to the unauthenticated admin panel on the loopback interface. From there they read the plaintext Active Directory service account credentials stored in the connector's configuration, then use those credentials to authenticate directly against Active Directory as a trusted service principal, pivoting further into the directory or into any downstream system (including AI/ML platforms) that trusts AD-based authentication. Alternatively, the attacker modifies connector settings to redirect or disrupt authentication flows for applications relying on this connector.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.