CVE-2026-55164: Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.passwor

Executive brief

Netflix Lemur, a certificate management framework, contains a flaw where user passwords updated by an administrator are stored in plain text rather than being securely hashed. This means that if the underlying database is compromised or accessed via backups, an attacker could obtain usable credentials for all affected users. Additionally, because the system expects hashed passwords, users whose passwords were changed by an admin will be unable to log in until the issue is corrected.

Technical details

A vulnerability exists in the `lemur.users.service.update()` function where new passwords assigned via the `PUT /api/1/users/<id>` endpoint are written directly to the database in plaintext. While the `User` model includes a bcrypt hashing routine, it is only registered to SQLAlchemy's `before_insert` event and not the `before_update` event. An authenticated attacker with administrative privileges can trigger this by updating a user profile, causing the `password` column to be updated without invoking `hash_password()`. This results in a defense-in-depth failure where database exfiltration (via SQLi, backups, or logs) reveals raw credentials. The issue is fixed in version 1.9.2 by adding the missing event listener.

Affected products

• Netflix Lemur <= 1.9.1

Timeline

• 2026-06-10: disclosed: Initial report to Netflix/lemur
• 2026-06-25: advisory: GitHub Advisory published
• 2026-06-25: patched: Version 1.9.2 released

References

• https://api.github.com/users/sour-exploit
• https://github.com/sour-exploit
• https://api.github.com/users/sour-exploit/gists%7B/gist_id%7D
• https://api.github.com/users/sour-exploit/repos
• https://avatars.githubusercontent.com/u/288231323?v=4
• https://api.github.com/users/sour-exploit/events%7B/privacy%7D