External risk intelligence

GRR Remote Code Execution via LDAP Configuration

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-58256

GRR is a resource management and reservation application. While such applications are often deployed on internal networks for organizational use, they can be plausibly exposed to the internet in some deployments to allow remote reservation access. The requirement for administrative privileges and interaction with LDAP settings suggests it is not a default internet-facing edge service.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the GRR resource management application, allowing for remote code execution when an administrator configures an attacker-controlled LDAP server. This issue arises from insufficient validation of input in the LDAP connector configuration, specifically through parameters like `ldap_filter`. The vulnerability has been addressed in version 4.5.0 of the application.

Malicious input allows code execution.
Impacts resource management and reservation systems.
Confirm relevance and exposure to critical systems.

Attack Path

How an attacker could exploit the issue

An attacker with administrative privileges could begin by controlling an LDAP server. They would then need to connect to the GRR application and submit malicious PHP code within the LDAP connector's configuration, specifically in parameters like `ldap_filter`. This poisoned configuration would allow the attacker to achieve remote code execution on the GRR system.

Administrator access required.
Malicious PHP via LDAP configuration.
Remote code execution possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in GRR, a resource management and reservation application, could allow an administrator to execute arbitrary code on the affected system. This is possible when an administrator connects to a potentially attacker-controlled LDAP server and then submits malicious input on the connector settings page, which can poison configuration files. This could lead to unauthorized system access and modification.

System configuration files could be altered.
Malicious PHP code could be injected via LDAP settings.
Remote code execution could occur on the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts GRR, a resource management and reservation application. Responsibility for remediation likely falls to the application owner and infrastructure teams, with support from security and potentially vendor management if GRR is a third-party product. The initial practical step is to identify all GRR instances, confirm their exposure and criticality, and then assign ownership for a risk-based remediation plan.

Application owners should drive remediation.
Verify GRR deployment reachability and criticality.
Plan coordinated updates or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GRR and what is it used for?

GRR is a web-based resource management and reservation application. Organizations typically use it to handle scheduling for shared assets, such as meeting rooms, equipment, or other company resources, through a centralized interface.

What is the vulnerability class for CVE-2026-58256?

This vulnerability is classified as CWE-94: Improper Control of Generation of Code. In plain terms, the application fails to properly sanitize input, allowing an attacker to inject and execute malicious PHP code within the system's configuration files.

How does an attacker trigger this RCE?

To trigger this, an attacker must have administrative access and successfully point the application to an LDAP server they control. They then inject malicious PHP code into LDAP connector configuration fields, such as the filter parameter, which the system writes to a configuration file.

Do I need to worry if my GRR instance is internal?

According to Halo Surface Signal, GRR is often used internally but can be exposed to the internet for remote access. While administrative access is required, any instance reachable over a network—whether public or internal—presents a potential surface for this issue.

How do I secure my environment against this threat?

The primary response is to update your GRR installation to version 4.5.0, where this issue is resolved. You should first identify all instances of GRR in your environment, assess their criticality, and coordinate an update to the patched version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.