CVE-2026-44305: Netflix Lemur TLS certificate verification bypass in LDAP authentication

CVE-2026-44305 · Severity: medium · CVSS 6.8 · Published 2026-05-12

Netflix Lemur, a tool used to manage and automate TLS certificate creation, contains a security flaw in how it connects to corporate identity directories (LDAP). When encrypted communication is enabled, the system fails to verify the identity of the directory server, allowing a nearby attacker to intercept sensitive login credentials. This could lead to unauthorized access to the certificate management system and the private keys it protects.

Technologies: lemur (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44305 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44305 being exploited in the wild.
How severe is CVE-2026-44305?
Medium severity, with a CVSS score of 6.8, published 12 May 2026.
Which products and versions are affected?
lemur (PyPI) < 1.9.0, ECOSYSTEM:introduced=0,fixed=1.9.0.
Is there a fix for CVE-2026-44305?
Yes. lemur (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44305 attacked?
It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-44305?
Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lemur (PyPI): upgrade to 1.9.0 or later
    pip install "lemur>=1.9.0"

Technical details

A vulnerability in Lemur's LDAP authentication module (lemur/auth/ldap.py) exists due to the improper use of the global ldap.set_option() method. When LDAP_USE_TLS is enabled, the application sets OPT_X_TLS_REQUIRE_CERT to OPT_X_TLS_NEVER at the global module level, disabling certificate verification for the entire Python process. An attacker positioned on the adjacent network can perform a man-in-the-middle attack to intercept plaintext credentials or modify LDAP responses to escalate privileges. The issue is resolved in version 1.9.0 by switching to instance-level options and enforcing certificate validation.

Affected products

  • Netflix Lemur < 1.9.0

Identifiers

  • CVE-2026-44305
  • GHSA-vr7c-r5gj-j3w5
  • PYSEC-2026-2590

Timeline

  • 2026-04-28: advisory: GitHub Security Advisory published
  • 2026-05-12: disclosed: CVE published to NVD
  • 2026-05-12: patched: Fixed in version 1.9.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.