Hard-Coded RSA Key in go-ldap-admin Exposes User Credentials

CVE-2026-111347

What is CVE-2026-111347?

The go-ldap-admin tool, up to version 0.6.2, contains a significant security flaw due to the inclusion of a hard-coded RSA private key within its source code. This key, which is openly accessible in the public repository, is used to protect encrypted login passwords. As a result, unauthenticated attackers can exploit this vulnerability to capture encrypted passwords and subsequently decrypt them offline or via the exposed /base/decryptpwd endpoint. This allows for the recovery of cleartext LDAP credentials, posing a severe risk to the security of user accounts and sensitive information.

References