Fabric CA, a Certificate Authority for Hyperledger Fabric, has an LDAP injection vulnerability (CVE-2026-53658) in versions before 1.5.21. The vulnerability arises because the Client.GetUser function inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters. This flaw enables an unauthenticated attacker with network access to the CA enrollment endpoint to alter the LDAP search query before password validation, potentially steering authentication attempts toward victim accounts. The vulnerability is specific to deployments using an LDAP backend and is resolved in version 1.5.21.

An unauthenticated attacker with network access to the enrollment endpoint can manipulate LDAP queries to redirect authentication attempts to other user accounts, potentially enabling unauthorized access or account confusion. Deployments without LDAP backends are not impacted.

Upgrade Fabric CA to version 1.5.21 or later, where the vulnerability is fixed by properly escaping LDAP metacharacters in the username before constructing the LDAP UserFilter. No other mitigation is required.