CVE-2026-111347

High · CVSS 8.2

Published 2026-10-15

CVSS

8.2

High

EPSS

—

exploit probability

Active Exploit

not yet listed

High — patch soon — High severity. Target patch within 7 days.

What is CVE-2026-111347?

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.

CVSS Score Explained

CVSS 8.2 is High severity. Exploitation is likely straightforward and the impact is significant — data loss, privilege escalation, or remote code execution are common outcomes. Patch as soon as possible.

EPSS Exploitation Probability

No EPSS score yet — model needs more data on this CVE.

References & Patches

Track vulnerabilities for your stack

Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.

Set up my stack watchlist What is a CVE?

Recent CVEs

Browse all CVEs →CISA KEV list →My watchlist →