MEDIUM

CVE-2026-53658

2026-09-15 CVSS v4.0

CVSS

6.3

Description

Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters. An unauthenticated attacker with network access to the CA enrollment endpoint can alter the LDAP search before password validation and potentially steer authentication attempts toward a victim account. Deployments that do not use an LDAP backend are unaffected. This issue is fixed in version 1.5.21.

Weakness (CWE)

CWE-90

EPSS Score

0.26%

Probability of exploitation in next 30 days

18.2th percentile

References

https://github.com/hyperledger/fabric-ca/commit/d379df823534d56dec0166a6da8f0415e3beee24 https://github.com/hyperledger/fabric-ca/pull/501 https://github.com/hyperledger/fabric-ca/releases/tag/v1.5.21 https://github.com/hyperledger/fabric-ca/security/advisories/GHSA-xghw-p77p-3r7x

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE