Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters. An unauthenticated attacker with network access to the CA enrollment endpoint can alter the LDAP search before password validation and potentially steer authentication attempts toward a victim account. Deployments that do not use an LDAP backend are unaffected. This issue is fixed in version 1.5.21.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00261.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-xghw-p77p-3r7x Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/hyperledger/fabric-ca/commit/d379df823534d56dec0166a6da8f0415e3beee24 cve-icon cve-icon
https://github.com/hyperledger/fabric-ca/pull/501 cve-icon cve-icon
https://github.com/hyperledger/fabric-ca/releases/tag/v1.5.21 cve-icon cve-icon
https://github.com/hyperledger/fabric-ca/security/advisories/GHSA-xghw-p77p-3r7x cve-icon cve-icon
History

Wed, 16 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters. An unauthenticated attacker with network access to the CA enrollment endpoint can alter the LDAP search before password validation and potentially steer authentication attempts toward a victim account. Deployments that do not use an LDAP backend are unaffected. This issue is fixed in version 1.5.21.
Title Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter
Weaknesses CWE-90
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-16T15:37:16.265Z

Reserved: 2026-06-09T20:50:36.877Z

Link: CVE-2026-53658

cve-icon Vulnrichment

Updated: 2026-09-16T15:37:13.424Z

cve-icon NVD

Status : Received

Published: 2026-09-15T17:17:18.943

Modified: 2026-09-16T16:17:08.380

Link: CVE-2026-53658

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T03:15:06Z

Weaknesses