CVE-2026-85983 PUBLISHED

Local Privilege Escalation in Auth0 AD/LDAP Connector

Assigner: Okta
Reserved: 04.09.2026 Published: 08.09.2026 Updated: 08.09.2026

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Auth0
Product	Auth0 AD/LDAP Connector
Versions	Default: unaffected affected from 0 to 6.5.0 (incl.)

Solutions

Upgrade the auth0/ad-ldap-connector to version 7.00 or greater.

References

https://trust.okta.com/security-advisories/local-privilege-escalation-in-auth0-ad-ldap-connector-cve-2026-85983

Problem Types

Improper Control of Generation of Code