PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111347 opsre CVE debrief

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse. This vulnerability allows unauthorized access to LDAP systems, emphasizing the need for immediate remediation, especially in deployments exposed to untrusted networks. The hard-coded key's presence in the public repository increases the risk, as attackers can easily access and exploit it.

Vendor
opsre
Product
go-ldap-admin
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-15
Original CVE updated
2026-10-16
Advisory published
2026-10-15
Advisory updated
2026-10-16

Who should care

Defenders responsible for go-ldap-admin deployments, especially those exposed to untrusted networks, should assess their exposure and prioritize remediation. This includes IT security teams, system administrators, and network operators who manage LDAP systems and are responsible for ensuring the security and integrity of LDAP credentials. Additionally, vulnerability management teams should be aware of the potential risks and plan for timely remediation.

Why it matters

Defenders should prioritize verifying and remediating affected go-ldap-admin deployments, especially those exposed to untrusted networks, due to the potential for unauthorized access to LDAP credentials.

  • Recovery of cleartext LDAP credentials can lead to unauthorized access to LDAP systems
  • Decrypting encrypted passwords can be done offline or via the /base/decryptpwd endpoint
  • Unauthenticated attackers can exploit this vulnerability to gain access to sensitive information
  • Remediation priority is high due to the potential for unauthorized access to LDAP credentials

Technical summary

The go-ldap-admin package through version 0.6.2 embeds a hard-coded RSA private key that protects encrypted login passwords. Unauthenticated attackers can decrypt these passwords offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials. This vulnerability stems from the insecure practice of hard-coding cryptographic keys, which can be easily exploited to gain unauthorized access to LDAP systems. The impact is heightened by the key's presence in the public repository, making it easily accessible to attackers.

Defensive priority

Defenders should prioritize verifying and remediating affected go-ldap-admin deployments, especially those exposed to untrusted networks.

Recommended defensive actions

  • Verify go-ldap-admin deployments for exposure to untrusted networks
  • Remediate affected go-ldap-admin deployments by updating to a non-affected version
  • Monitor for unauthorized access to LDAP credentials
  • Implement compensating controls to protect LDAP credentials
  • Review and update incident response plans to address potential exploitation
  • Conduct a thorough review of system configurations and network exposure
  • Engage with the vendor for support and guidance on remediation

Evidence notes

The CVE record and source item provide details on the hard-coded RSA private key and its impact on go-ldap-admin. However, the corpus does not provide information on exploitation or affected deployments.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111347 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111347

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111347 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111347

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111347.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/go-ldap-admin-hardcoded-rsa-key-decrypt-oracle-and-unauth-password-reset

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/opsre/go-ldap-admin/blob/v0.6.2/config/config.go

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/opsre/go-ldap-admin/blob/v0.6.2/routes/base_routes.go

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/opsre/go-ldap-admin/blob/v0.6.2/logic/base_logic.go

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/opsre/go-ldap-admin

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/go-ldap-admin-through-0.6.2-hard-coded-rsa-private-key-via-base-decryptpwd

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.