Apache Syncope admin REST API exposes connector credentials
Incorrect authorization in Apache Syncope allows any administrator in a given Realm to read the full Connector configuration via REST, including plaintext credentials for LDAP directories, Active Directory, and external databases.
- Vendor
- Apache
- Product
- Syncope
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-73668 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-73668 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-11 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-11. Full cross-catalog view: /kev-comparison
CVE-2026-73668 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Apache Syncope Connectors define how Syncope communicates with external identity systems: LDAP servers, Active Directory, relational databases, and other backends. These Connector objects store credentials for those systems.
CVE-2026-73668 allows any Syncope administrator with entitlements in a given Realm to retrieve the full Connector configuration through the REST API, including the stored credentials in plaintext. There is no requirement for the administrator to own or manage the Connector directly.
After patching, rotate credentials stored in all Connector objects. LDAP bind passwords and database service accounts are the highest-priority items. See the full advisory and the Apache Syncope patch article.
Other Apache CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2016-3081 Apache Struts Command Injection Vulnerability | [ HIGH ] | 8.1 | 96.9% | |
| CVE-2026-87802 Apache Syncope SRA allows JWT forgery without JWKS URIwrite-up | [ CRITICAL ] | 9.1 | 0.3% | — |
| CVE-2026-87785 Apache Syncope JWT authentication bypass via JWKS spoofingwrite-up | [ CRITICAL ] | 9.1 | 0.5% | — |
| CVE-2026-86460 Apache Syncope Cypher injection via Neo4j FIQL searchwrite-up | [ CRITICAL ] | 9.8 | 0.6% | — |
| CVE-2026-82232 Apache Syncope admin-level SQL injectionwrite-up | [ CRITICAL ] | 9.8 | 0.6% | — |
| CVE-2026-73579 Apache Syncope search injection via FIQL to SQL/Neo4j/Elasticsearchwrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-73470 Apache Syncope improper privilege management in delegationswrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | [ HIGH ] | 7.5 | 98.5% |
