{"cve":"CVE-2026-53658","nvd":{"published":"2026-09-15T17:17:18.943","modified":"2026-09-30T17:43:24.057","status":"Awaiting Analysis","description":"Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters. An unauthenticated attacker with network access to the CA enrollment endpoint can alter the LDAP search before password validation and potentially steer authentication attempts toward a victim account. Deployments that do not use an LDAP backend are unaffected. This issue is fixed in version 1.5.21.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.3},"cvss_v3":null,"cwes":["CWE-90"],"references":["https://github.com/hyperledger/fabric-ca/commit/d379df823534d56dec0166a6da8f0415e3beee24","https://github.com/hyperledger/fabric-ca/pull/501","https://github.com/hyperledger/fabric-ca/releases/tag/v1.5.21","https://github.com/hyperledger/fabric-ca/security/advisories/GHSA-xghw-p77p-3r7x"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-53658","score":0.0045,"percentile":0.38834,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-xghw-p77p-3r7x","url":"https://osv.dev/vulnerability/GHSA-xghw-p77p-3r7x","summary":"Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter","modified":"2026-08-18T17:23:59.170170132Z","packages":[{"ecosystem":"Go","name":"github.com/hyperledger/fabric-ca","purl":"pkg:golang/github.com/hyperledger/fabric-ca","ranges":["<1.5.21"],"fixed":["1.5.21"]}]},{"id":"GO-2026-6234","url":"https://osv.dev/vulnerability/GO-2026-6234","summary":"LDAP injection via unescaped username in github.com/hyperledger/fabric-ca","modified":"2026-08-18T17:15:27.921210823Z","packages":[{"ecosystem":"Go","name":"github.com/hyperledger/fabric-ca","purl":"pkg:golang/github.com/hyperledger/fabric-ca","ranges":["<1.5.21"],"fixed":["1.5.21"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}