GHSA-xghw-p77p-3r7x

Source

https://github.com/advisories/GHSA-xghw-p77p-3r7x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xghw-p77p-3r7x/GHSA-xghw-p77p-3r7x.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-xghw-p77p-3r7x

Aliases

Published

2026-08-14T19:24:57Z

Modified

2026-08-18T17:25:50Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter

Details

When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before password validation, and potentially steer authentication attempts toward a victim account.

Recommendation

All users of fabric-ca with an LDAP backend should update to a fixed version.
For users not using an LDAP backend, no action is required.

Database specific

{
    "cwe_ids": [
        "CWE-90"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-14T19:24:57Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/hyperledger/fabric-ca

Package

Name: github.com/hyperledger/fabric-ca; View open source insights on deps.dev
Purl: pkg:golang/github.com/hyperledger/fabric-ca

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.21

Database specific

last_known_affected_version_range

"<= 1.5.20"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xghw-p77p-3r7x/GHSA-xghw-p77p-3r7x.json"