Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter (CVE-2026-53658)
When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before password validation, and potentially steer authentication attempts toward a victim account. ### Recommendation - All users of fabric-ca with an LDAP backend should update to a fixed version. - For users not using an LDAP backend, no action is required.
AI Analysis
Technical Summary
When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is incorporated into an LDAP uid search filter without proper escaping. This improper input handling leads to LDAP injection vulnerability (CWE-90). An unauthenticated attacker with network access to the enrollment endpoint can exploit this flaw to influence LDAP queries prior to password validation, potentially steering authentication attempts toward victim accounts. The vulnerability affects fabric-ca versions before 1.5.21. A fix has been released to correct this issue.
Potential Impact
An unauthenticated attacker with network access to the enrollment endpoint can perform LDAP injection, potentially manipulating authentication attempts to target victim accounts. This could lead to unauthorized access or authentication bypass scenarios depending on the LDAP backend's behavior. The impact is rated medium/moderate severity.
Mitigation Recommendations
Users of fabric-ca with an LDAP backend should update to version 1.5.21 or later where the vulnerability is fixed. Users not using an LDAP backend do not need to take any action. Since a patch is available, applying the official fix is the recommended remediation.
Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter (CVE-2026-53658)
Description
When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before password validation, and potentially steer authentication attempts toward a victim account. ### Recommendation - All users of fabric-ca with an LDAP backend should update to a fixed version. - For users not using an LDAP backend, no action is required.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is incorporated into an LDAP uid search filter without proper escaping. This improper input handling leads to LDAP injection vulnerability (CWE-90). An unauthenticated attacker with network access to the enrollment endpoint can exploit this flaw to influence LDAP queries prior to password validation, potentially steering authentication attempts toward victim accounts. The vulnerability affects fabric-ca versions before 1.5.21. A fix has been released to correct this issue.
Potential Impact
An unauthenticated attacker with network access to the enrollment endpoint can perform LDAP injection, potentially manipulating authentication attempts to target victim accounts. This could lead to unauthorized access or authentication bypass scenarios depending on the LDAP backend's behavior. The impact is rated medium/moderate severity.
Mitigation Recommendations
Users of fabric-ca with an LDAP backend should update to version 1.5.21 or later where the vulnerability is fixed. Users not using an LDAP backend do not need to take any action. Since a patch is available, applying the official fix is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xghw-p77p-3r7x
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53658"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a7ff5f6bf8831d53988009c
Added to database: 08/15/2026, 05:15:34 UTC
Last enriched: 08/15/2026, 05:42:21 UTC
Last updated: 08/15/2026, 18:57:45 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.