# CVE-2026-44304: Netflix Lemur LDAP injection in authentication module

Source: https://junglewise.ai/threats/cve-2026-44304-netflix-lemur-ldap-injection-in-ldap-authentication-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44304 · Severity: high · CVSS 8.1 · Published 2026-05-12

Netflix Lemur, a tool used to manage and automate the creation of TLS certificates, contains a security flaw in its login system. An attacker with valid standard user credentials can manipulate the login process to trick the system into granting them administrator privileges. This would allow the attacker to access sensitive private keys, modify certificate authority configurations, and issue unauthorized security certificates.

Technologies: [lemur (PyPI)](https://junglewise.ai/threats/technologies/lemur). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44304 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44304 being exploited in the wild.

**How severe is CVE-2026-44304?** High severity, with a CVSS score of 8.1, published 12 May 2026.

**Which products and versions are affected?** lemur (PyPI) < 1.9.0, ECOSYSTEM:introduced=0,fixed=1.9.0.

**Is there a fix for CVE-2026-44304?** Yes. lemur (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44304 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44304?** Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lemur (PyPI): upgrade to 1.9.0 or later

  ```sh
  pip install "lemur>=1.9.0"
  ```


## Technical details

An LDAP injection vulnerability exists in Lemur's authentication module (lemur/auth/ldap.py) due to the use of unsanitized user input in Python string interpolation when constructing LDAP search filters. Specifically, the 'username' field provided during login is interpolated directly into the user lookup filter without escaping special characters. An attacker with valid LDAP credentials can inject LDAP metacharacters to manipulate group membership queries. This allows the attacker to be assigned privileged roles, such as administrator, granting them full access to certificates, private keys, and CA configurations. The issue is fixed in version 1.9.0 by implementing proper escaping using ldap.filter.escape_filter_chars().

## Affected products

- Netflix Lemur < 1.9.0

## Identifiers

- CVE-2026-44304
- GHSA-3r34-vq8m-39gh
- PYSEC-2026-2585

## Timeline

- 2026-04-28: advisory: GitHub advisory published by maintainers
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fixed in version 1.9.0

## References

- [https://github.com/Netflix/lemur/security/advisories/GHSA-3r34-vq8m-39gh](https://github.com/Netflix/lemur/security/advisories/GHSA-3r34-vq8m-39gh)

## Related threats

- [Netflix Lemur arbitrary certificate revocation via duplicate upload](https://junglewise.ai/threats/cve-2026-71417-netflix-lemur-arbitrary-certificate-revocation-via-duplicate)
- [Netflix Lemur missing authorization check on POST /certificates/<id>/export](https://junglewise.ai/threats/cve-2026-71322-netflix-lemur-missing-authorization-check-on-post-certificates-id)
- [Netflix Lemur sub-CA creation authorization bypass](https://junglewise.ai/threats/cve-2026-71317-netflix-lemur-sub-ca-creation-authorization-bypass)
- [Netflix Lemur unchecked replaces authorization bypass](https://junglewise.ai/threats/cve-2026-71308-netflix-lemur-unchecked-replaces-authorization-bypass)
- [Netflix Lemur destinations API authorization bypass](https://junglewise.ai/threats/cve-2026-71307-netflix-lemur-destinations-api-authorization-bypass)