The vulnerability stems from a hard‑c­oded RSA private key embedded in go‑ldap‑admin configuration. Because the key is publicly visible, the /base/decryptpwd endpoint can decrypt encrypted LDAP login passwords without authentication. An unauthenticated attacker who captures encrypted credentials can use the endpoint or the exposed key to recover clear‑text LDAP credentials, enabling them to authenticate as any user in the directory and potentially move laterally.

Operated by opsre, go‑ldap‑admin up to version 0.6.2 contains the hard‑coded RSA private key as shown in the repository's config.go. All releases prior to any removal of the key are considered vulnerable. No supported official patch version is indicated in the provided data.

The CVSS score of 8.2 classifies this as high severity. The EPSS score is <1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The /base/decryptpwd endpoint is reachable without credentials, making exploitation straightforward once the attacker has captured an encrypted password. The high severity and ease of exploitation result in a significant risk to confidentiality of LDAP credentials.