GitHub Advisoryadvisory · Go

GHSA-xghw-p77p-3r7x Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter

MEDIUM Published 2026-08-14 Modified 2026-08-14 Official page ↗
Aliases
CVE-2026-53658
Ecosystem
Go
Packages
github.com/hyperledger/fabric-ca
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-90
Reviewed
2026-08-14

Affected packages

• Go github.com/hyperledger/fabric-ca: < 1.5.21 → fixed in 1.5.21

Description

When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before password validation, and potentially steer authentication attempts toward a victim account. Recommendation • All users of fabric-ca with an LDAP backend should update to a fixed version. • For users not using an LDAP backend, no action is required.

Related

Alias · CVE (1)

  • CVE-2026-53658 Fabric CA is a Certificate Authority for Hyperledger Fabric. vulnerability

Weakness · CWE (1)

  • CWE-90 Improper Neutralization of Special Elements used in an LDAP Query weakness

References