# CVE-2026-44305: Netflix Lemur TLS certificate verification bypass in LDAP authentication

Source: https://junglewise.ai/threats/cve-2026-44305-netflix-lemur-improper-certificate-validation-in-ldap  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44305 · Severity: medium · CVSS 6.8 · Published 2026-05-12

Netflix Lemur, a tool used to manage and automate TLS certificate creation, contains a security flaw in how it connects to corporate identity directories (LDAP). When encrypted communication is enabled, the system fails to verify the identity of the directory server, allowing a nearby attacker to intercept sensitive login credentials. This could lead to unauthorized access to the certificate management system and the private keys it protects.

Technologies: [lemur (PyPI)](https://junglewise.ai/threats/technologies/lemur). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44305 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44305 being exploited in the wild.

**How severe is CVE-2026-44305?** Medium severity, with a CVSS score of 6.8, published 12 May 2026.

**Which products and versions are affected?** lemur (PyPI) < 1.9.0, ECOSYSTEM:introduced=0,fixed=1.9.0.

**Is there a fix for CVE-2026-44305?** Yes. lemur (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44305 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-44305?** Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lemur (PyPI): upgrade to 1.9.0 or later

  ```sh
  pip install "lemur>=1.9.0"
  ```


## Technical details

A vulnerability in Lemur's LDAP authentication module (lemur/auth/ldap.py) exists due to the improper use of the global ldap.set_option() method. When LDAP_USE_TLS is enabled, the application sets OPT_X_TLS_REQUIRE_CERT to OPT_X_TLS_NEVER at the global module level, disabling certificate verification for the entire Python process. An attacker positioned on the adjacent network can perform a man-in-the-middle attack to intercept plaintext credentials or modify LDAP responses to escalate privileges. The issue is resolved in version 1.9.0 by switching to instance-level options and enforcing certificate validation.

## Affected products

- Netflix Lemur < 1.9.0

## Identifiers

- CVE-2026-44305
- GHSA-vr7c-r5gj-j3w5
- PYSEC-2026-2590

## Timeline

- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fixed in version 1.9.0

## References

- [https://github.com/Netflix/lemur/security/advisories/GHSA-vr7c-r5gj-j3w5](https://github.com/Netflix/lemur/security/advisories/GHSA-vr7c-r5gj-j3w5)

## Related threats

- [Netflix Lemur arbitrary certificate revocation via duplicate upload](https://junglewise.ai/threats/cve-2026-71417-netflix-lemur-arbitrary-certificate-revocation-via-duplicate)
- [Netflix Lemur missing authorization check on POST /certificates/<id>/export](https://junglewise.ai/threats/cve-2026-71322-netflix-lemur-missing-authorization-check-on-post-certificates-id)
- [Netflix Lemur sub-CA creation authorization bypass](https://junglewise.ai/threats/cve-2026-71317-netflix-lemur-sub-ca-creation-authorization-bypass)
- [Netflix Lemur unchecked replaces authorization bypass](https://junglewise.ai/threats/cve-2026-71308-netflix-lemur-unchecked-replaces-authorization-bypass)
- [Netflix Lemur destinations API authorization bypass](https://junglewise.ai/threats/cve-2026-71307-netflix-lemur-destinations-api-authorization-bypass)