Hyperledger fabric-ca CVE-2026-53658

Exploitation requires that fabric-ca be explicitly configured with an LDAP backend - the ldap configuration block in fabric-ca-server-config.yaml must reference an active LDAP server. The CA enrollment endpoint must be reachable by the attacker over the network. No credentials are required; the injection payload is carried in the username field of HTTP Basic Auth and takes effect before password validation. fabric-ca deployments using the default local SQLite or PostgreSQL identity stores are entirely unaffected regardless of network exposure. Meaningful exploitation also requires the attacker to know or enumerate a valid victim username in the LDAP directory in order to steer authentication toward a specific account.

No CVSS vector or EPSS score was supplied with this advisory, so quantitative risk signals are unavailable and must be inferred from the description and patch diff. The attack is network-accessible and requires no authentication, as injection occurs in the username field of HTTP Basic Auth before password validation - a materially dangerous pre-auth position. However, exploitation requires that fabric-ca be explicitly configured with an LDAP backend, a non-default operator decision, which substantially narrows the affected population. The primary impact is manipulation of LDAP authentication logic: an attacker can redirect the uid search filter to match a victim account, potentially enabling certificate issuance under a false identity. In Hyperledger Fabric's trust model, unauthorized certificate issuance carries chain-of-trust consequences that extend beyond the CA instance itself, elevating the effective integrity risk. No public exploit code and no CISA KEV listing have been identified, which reduces immediate urgency; however, any operator running an LDAP-backed fabric-ca should treat this as a near-term patch priority given the privileged role of a CA. EPSS data is absent, so exploitation probability cannot be independently quantified.

An attacker with network access to a fabric-ca enrollment endpoint sends an HTTP Basic authentication request where the username field contains crafted LDAP filter syntax - for example, *)(uid=victim)(|(uid=* - which, when interpolated unescaped into the uid search filter, causes the LDAP directory to match an unintended entry. The manipulated filter resolves to the victim account before password validation runs, potentially allowing the attacker to redirect the enrollment flow and obtain a certificate bound to the victim's identity. No public proof-of-concept code has been identified, but the technique is well-understood and straightforward for anyone familiar with LDAP filter syntax.