Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters. An unauthenticated attacker with network access to the CA enrollment endpoint can alter the LDAP search before password validation and potentially steer authentication attempts toward a victim account. Deployments that do not use an LDAP backend are unaffected. This issue is fixed in version 1.5.21.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| hyperledger | fabric-ca | before 1.5.21 | 1.5.21 | Patch available | CNA |
| — | github.com/hyperledger/fabric-ca (Go) | before 1.5.21 | 1.5.21 | Patch available | GHSA-xghw-p77p-3r7x |
- fabric-ca Vendorhyperledger Affected before 1.5.21 Fixed in 1.5.21 Patch available CNA
- github.com/hyperledger/fabric-ca (Go) Vendor— Affected before 1.5.21 Fixed in 1.5.21 Patch available GHSA-xghw-p77p-3r7x
Remediation
- Fix · CNA fabric-ca (hyperledger) Fixed in 1.5.21
- Fix · GHSA-xghw-p77p-3r7x github.com/hyperledger/fabric-ca (Go) Fixed in 1.5.21 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53658
- 2026-10-03 Alias added: GHSA-xghw-p77p-3r7x
References
Other 5
- https://github.com/hyperledger/fabric-ca/security/advisories/GHSA-xghw-p77p-3r7x
- https://github.com/hyperledger/fabric-ca/pull/501
- https://github.com/hyperledger/fabric-ca/commit/d379df823534d56dec0166a6da8f0415e3beee24
- https://github.com/hyperledger/fabric-ca/releases/tag/v1.5.21
- https://github.com/hyperledger/fabric-ca
More hyperledger vulnerabilities
- TI-2026-30139 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE CVSS 4.0CRITICAL 9.3
- TI-2024-14390 Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC CVSS 3.1CRITICAL 9.9
- TI-2022-13066 Unlinkability broken in ursa when verifiers use malicious keys CVSS 3.1MEDIUM 5.3
- TI-2022-16450 Incorrect Conversion between Numeric Types in Besu Ethereum Client CVSS 3.1CRITICAL 9.1
- TI-2022-13065 Remote code execution in Indy's NODE_UPGRADE transaction CVSS 3.1HIGH 8.8
- TI-2025-21486 ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve CVSS 4.0HIGH 8.7
Sources
- CVE-2026-53658 · CVE Program
- CVE-2026-53658 · NVD
- FIRST EPSS
- GHSA-xghw-p77p-3r7x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences