Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M
CVE-2026-53658Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter
Medium 6.3
In plain English
A medium-severity security flaw in fabric-ca from hyperledger. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters. An unauthenticated attacker with network access to the CA enrollment endpoint can alter the LDAP search before password validation and potentially steer authentication attempts toward a victim account. Deployments that do not use an LDAP backend are unaffected. This issue is fixed in version 1.5.21.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hyperledger/fabric-ca | 1.5.21 | GHSA-xghw-p77p-3r7x |
| Go | github.com/hyperledger/fabric-ca | 1.5.21 | GO-2026-6234 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hyperledger | fabric-ca | < 1.5.21 |
Weakness: CWE-90 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/hyperledger/fabric-ca/security/advisories/GHSA-xghw-p77p-3r7x x_refsource_CONFIRM
- https://github.com/hyperledger/fabric-ca/pull/501 x_refsource_MISC
- https://github.com/hyperledger/fabric-ca/commit/d379df823534d56dec0166a6da8f0415e3beee24 x_refsource_MISC
- https://github.com/hyperledger/fabric-ca/releases/tag/v1.5.21 x_refsource_MISC