Executive brief
Hyperledger Fabric CA is a certificate authority component used in blockchain networks to manage digital identities and credentials. When configured to use LDAP for user authentication, the system improperly handles usernames in authentication requests, allowing attackers to inject LDAP query commands. This could enable an attacker to authenticate as a different user or access sensitive directory information without valid credentials.
Technical details
The vulnerability is an LDAP injection (CWE-90) in the GetUser filter of Fabric CA. When processing HTTP Basic authentication, the username is inserted into an LDAP UID search filter without proper escaping of LDAP special characters. This occurs in the vulnerable code path at lib/server/ldap/client.go:175 before password validation is performed. An unauthenticated, network-accessible attacker can exploit this by crafting a malicious username containing LDAP query operators (e.g., wildcards, Boolean operators) to modify the LDAP filter logic, potentially redirecting authentication to a different account or bypassing intended access controls. The fix was released in version 1.5.21 and earlier versions (≤ 1.5.20) remain vulnerable. Users not employing an LDAP backend are unaffected.
Affected products
- Hyperledger Fabric CA <= 1.5.20
Timeline
- 2026-06-19: disclosed
- 2026-08-14: advisory: GitHub Advisory Database publication