Answer in brief
CVE-2026-53658 records a Medium severity vulnerability in Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter. The current sources do not mark it as known exploited. The current feed maps hyperledger/fabric-ca (generic), github.com/hyperledger/fabric-ca (go), github.com/hyperledger/fabric-ca (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps hyperledger/fabric-ca (generic), github.com/hyperledger/fabric-ca (go), github.com/hyperledger/fabric-ca (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| hyperledger/fabric-cageneric | < 1.5.21 | Not reported |
| github.com/hyperledger/fabric-cago | >=0 <1.5.21 | 1.5.21 |
| github.com/hyperledger/fabric-cago | <=1.5.20 | 1.5.21 |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 14, 2026
Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters. An unauthenticated attacker with network access to the CA enrollment endpoint can alter the LDAP search before password validation and potentially steer authentication attempts toward a victim account. Deployments that do not use an LDAP backend are unaffected. This issue is fixed in version 1.5.21.
Quoted source text, attributed separately from HOL analysis.