CVE-2026-44304: Netflix Lemur LDAP injection in authentication module

CVE-2026-44304 · Severity: high · CVSS 8.1 · Published 2026-05-12

Netflix Lemur, a tool used to manage and automate the creation of TLS certificates, contains a security flaw in its login system. An attacker with valid standard user credentials can manipulate the login process to trick the system into granting them administrator privileges. This would allow the attacker to access sensitive private keys, modify certificate authority configurations, and issue unauthorized security certificates.

Technologies: lemur (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44304 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44304 being exploited in the wild.
How severe is CVE-2026-44304?
High severity, with a CVSS score of 8.1, published 12 May 2026.
Which products and versions are affected?
lemur (PyPI) < 1.9.0, ECOSYSTEM:introduced=0,fixed=1.9.0.
Is there a fix for CVE-2026-44304?
Yes. lemur (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44304 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44304?
Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lemur (PyPI): upgrade to 1.9.0 or later
    pip install "lemur>=1.9.0"

Technical details

An LDAP injection vulnerability exists in Lemur's authentication module (lemur/auth/ldap.py) due to the use of unsanitized user input in Python string interpolation when constructing LDAP search filters. Specifically, the 'username' field provided during login is interpolated directly into the user lookup filter without escaping special characters. An attacker with valid LDAP credentials can inject LDAP metacharacters to manipulate group membership queries. This allows the attacker to be assigned privileged roles, such as administrator, granting them full access to certificates, private keys, and CA configurations. The issue is fixed in version 1.9.0 by implementing proper escaping using ldap.filter.escape_filter_chars().

Affected products

  • Netflix Lemur < 1.9.0

Identifiers

  • CVE-2026-44304
  • GHSA-3r34-vq8m-39gh
  • PYSEC-2026-2585

Timeline

  • 2026-04-28: advisory: GitHub advisory published by maintainers
  • 2026-05-12: disclosed: CVE published to NVD
  • 2026-05-12: patched: Fixed in version 1.9.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.