hyperledger/fabric-ca · Security
Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter
- GHSA ID
- GHSA-xghw-p77p-3r7x
- CVE ID
- CVE-2026-53658
- Severity
- medium
- Published
- Updated
- CVSS v4
- 6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Description
When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before password validation, and potentially steer authentication attempts toward a victim account.
Recommendation
- All users of fabric-ca with an LDAP backend should update to a fixed version.
- For users not using an LDAP backend, no action is required.
CWEs
- CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')