CVE-2026-111347: go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd
go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.
Affected Software
Event History
Frequently Asked Questions
What must an attacker obtain to recover LDAP credentials?
The attacker needs to capture encrypted login passwords. Because the RSA private key is hard-coded and publicly available, those captured passwords can be decrypted offline or by using the /base/decryptpwd endpoint.
Is authentication required to use the exposed decryption capability?
No. The /base/decryptpwd endpoint can be used by unauthenticated attackers to recover cleartext LDAP credentials from encrypted passwords.
Which deployments are affected?
go-ldap-admin versions through 0.6.2 are affected. The issue stems from a private key embedded in the application, rather than a condition described as requiring a particular optional configuration.
What is the likely impact if exploitation succeeds?
An attacker can recover cleartext LDAP credentials and reuse them. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.