CVE-2026-111347 — go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd
go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who captu…
Published: 2026-10-15 · CVSS: 8.2 · CVSS 4.0
go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7