CVE-2026-53658: Go/github.com/hyperledger/fabric-ca vulnerability
When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before password validation, and potentially steer authentication attempts toward a victim account.
Recommendation
- All users of fabric-ca with an LDAP backend should update to a fixed version. - For users not using an LDAP backend, no action is required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/hyperledger/fabric-cato a version that resolves this vulnerability.Fixed in 1.5.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53658?
CVE-2026-53658 has a risk score of 57.
How do I fix CVE-2026-53658?
To fix CVE-2026-53658, ensure that input from HTTP Basic authentication is properly escaped before it is used in LDAP uid search filters.
What software is affected by CVE-2026-53658?
CVE-2026-53658 affects the fabric-ca software from the Hyperledger project.
Can CVE-2026-53658 be exploited remotely?
Yes, CVE-2026-53658 can be exploited by an unauthenticated attacker with network access to the CA enrollment endpoint.
What kind of attack is associated with CVE-2026-53658?
CVE-2026-53658 is associated with LDAP injection attacks due to improper escaping of the username in LDAP queries.