opsre go-ldap-admin: Use of hard-coded cryptographic key in password decryption
Summary
go-ldap-admin through version 0.6.2, a web admin panel for OpenLDAP, embeds an RSA private key in its public source code. This key protects encrypted login passwords. An unauthenticated attacker who captures encrypted passwords can decrypt them offline or through the /base/decryptpwd endpoint and recover cleartext LDAP credentials.
Affected
- go-ldap-admin versions 0 through 0.6.2
- Versions after 0.6.2: unknown
Fixed in
Unknown. No fixed version or patch has been published as of this entry.
Workaround
- Remove public exposure of the admin panel and restrict access to VPN or an allow-list.
- Disable or restrict the /base/decryptpwd endpoint if the panel must remain in use (temporary measure, does not fix the root cause).
Exploitation
- Public proof-of-concept write-up available (third-party, HackMD); exploitation status rated 'poc'.
- Attack requires no authentication and low complexity.
- Active exploitation in the wild: unknown. No CISA KEV listing confirmed.
Our recommendation
- Inventory all go-ldap-admin instances, including versions and internet exposure.
- Remove public access to the admin panel immediately.
- Restrict or disable the /base/decryptpwd endpoint until a fix is available.
- Rotate the LDAP bind and service credentials stored by the panel and review authentication logs for unusual activity.
- Monitor the upstream repository and NVD for a fixed release and re-assess once one is published.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-111347 on OSV osv.dev
- VulDB CVE-2026-111347 vuldb.com
- VulnCheck advisory www.vulncheck.com
- Proof-of-concept write-up (HackMD) hackmd.io
- go-ldap-admin config.go at v0.6.2 github.com
- go-ldap-admin base_routes.go at v0.6.2 github.com
- go-ldap-admin issue 447 github.com
- go-ldap-admin releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:55.
Original description (NVD)
go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.
NVD references (8)
- https://github.com/opsre/go-ldap-admin
- https://github.com/opsre/go-ldap-admin/blob/v0.6.2/config/config.go#L20-L24
- https://github.com/opsre/go-ldap-admin/blob/v0.6.2/config/config.go#L76-L77
- https://github.com/opsre/go-ldap-admin/blob/v0.6.2/logic/base_logic.go#L188-L199
- https://github.com/opsre/go-ldap-admin/blob/v0.6.2/routes/base_routes.go#L50
- https://hackmd.io/@hieuPenguinnn/go-ldap-admin-hardcoded-rsa-key-decrypt-oracle-and-unauth-password-reset
- https://www.vulncheck.com/advisories/go-ldap-admin-through-0.6.2-hard-coded-rsa-private-key-via-base-decryptp…
- https://hackmd.io/@hieuPenguinnn/go-ldap-admin-hardcoded-rsa-key-decrypt-oracle-and-unauth-password-reset
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.