CVE-2026-53658— Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter
Quick assessment
Affected
hyperledger fabric-ca
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Fabric CA 是 Hyperledger Fabric 的证书颁发机构（Certificate Authority）。在版本 1.5.21 之前，当 fabric-ca 配置了 LDAP 后端时，位于 中的 函数在将 HTTP 基本认证中的用户名插入 LDAP uid 搜索的 UserFilter 时，未对 LDAP 元字符进行转义。拥有 CA 注册端点网络访问权限的未认证攻击者，可以在密码验证之前操纵 LDAP 搜索，从而将认证尝试引导至目标账户。未使用 LDAP 后端的部署不受此问题影响。该问题已在版本
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| hyperledger | fabric-ca | < 1.5.21 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-53658
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter
Source: CVE Program / CVE List V5
Vulnerability Description
Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters. An unauthenticated attacker with network access to the CA enrollment endpoint can alter the LDAP search before password validation and potentially steer authentication attempts toward a victim account. Deployments that do not use an LDAP backend are unaffected. This issue is fixed in version 1.5.21.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
LDAP查询中使用的特殊元素转义处理不恰当(LDAP注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| hyperledger | fabric-ca | < 1.5.21 | - |
|
II. Public POCs for CVE-2026-53658
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-53658
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-53658 (2)
Vendor Advisories for CVE-2026-53658 (1)
Vendor Pages for CVE-2026-53658 (1)
-
🔗 Release v1.5.21 · hyperledger/fabric-ca · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: hyperledger
-
CVE-2026-45581
fabric-chaincode-java: TLS Private Key Password Disclosed in -
CVE-2026-41586
ObjectInputStream.readObject() without ObjectInputFilter in -
CVE-2025-30147
ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile func -
CVE-2022-31021
Unlinkability broken in ursa when verifiers use malicious ke -
CVE-2024-21669
Hyperledger Aries Cloud Agent Python result of presentation
Same weakness: CWE-90
-
CVE-2026-55770
OpenBao: LDAPi ldaputil (wrong escape func) -
CVE-2026-41573
OpenAM LDAP Injection via `_queryId` Parameter -
CVE-2026-46619
OpenAM Authentication Bypass via MSISDN LDAP Injection -
CVE-2026-80055
Dell Secure Connect Gateway 输入验证错误漏洞 -
CVE-2026-78579
Improper Input Sanitization in Okta Access Gateway LDAP Data
V. Comments for CVE-2026-53658
No comments yet