# CVE-2026-55164: Netflix Lemur plaintext password storage in user update service

Source: https://junglewise.ai/threats/cve-2026-55164-netflix-lemur-plaintext-password-storage-in-user-update-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-55164 · Severity: medium · CVSS 4.9 · Published 2026-08-18

Netflix Lemur, a certificate management framework, contains a flaw where user passwords updated by an administrator are stored in plain text rather than being securely hashed. This means that if the underlying database is compromised or accessed via backups, an attacker could obtain usable credentials for all affected users. Additionally, because the system expects hashed passwords, users whose passwords were changed by an admin will be unable to log in until the issue is corrected.

Technologies: [lemur (PyPI)](https://junglewise.ai/threats/technologies/lemur). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-55164 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55164 being exploited in the wild.

**How severe is CVE-2026-55164?** Medium severity, with a CVSS score of 4.9, published 18 August 2026.

**Which products and versions are affected?** lemur (PyPI) <= 1.9.1, ECOSYSTEM:introduced=0,fixed=1.9.2.

**Is there a fix for CVE-2026-55164?** Yes. lemur (PyPI): upgrade to 1.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55164 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55164?** Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lemur (PyPI): upgrade to 1.9.2 or later

  ```sh
  pip install "lemur>=1.9.2"
  ```


## Technical details

A vulnerability exists in the `lemur.users.service.update()` function where new passwords assigned via the `PUT /api/1/users/<id>` endpoint are written directly to the database in plaintext. While the `User` model includes a bcrypt hashing routine, it is only registered to SQLAlchemy's `before_insert` event and not the `before_update` event. An authenticated attacker with administrative privileges can trigger this by updating a user profile, causing the `password` column to be updated without invoking `hash_password()`. This results in a defense-in-depth failure where database exfiltration (via SQLi, backups, or logs) reveals raw credentials. The issue is fixed in version 1.9.2 by adding the missing event listener.

## Affected products

- Netflix Lemur <= 1.9.1

## Identifiers

- CVE-2026-55164
- GHSA-q437-g7fv-2jvv
- PYSEC-2026-2587

## Timeline

- 2026-06-10: disclosed: Initial report to Netflix/lemur
- 2026-06-25: advisory: GitHub Advisory published
- 2026-06-25: patched: Version 1.9.2 released

## References

- [https://api.github.com/users/sour-exploit](https://api.github.com/users/sour-exploit)
- [https://github.com/sour-exploit](https://github.com/sour-exploit)
- [https://api.github.com/users/sour-exploit/gists%7B/gist_id%7D](https://api.github.com/users/sour-exploit/gists%7B/gist_id%7D)
- [https://api.github.com/users/sour-exploit/repos](https://api.github.com/users/sour-exploit/repos)
- [https://avatars.githubusercontent.com/u/288231323?v=4](https://avatars.githubusercontent.com/u/288231323?v=4)
- [https://api.github.com/users/sour-exploit/events%7B/privacy%7D](https://api.github.com/users/sour-exploit/events%7B/privacy%7D)

## Related threats

- [Netflix Lemur arbitrary certificate revocation via duplicate upload](https://junglewise.ai/threats/cve-2026-71417-netflix-lemur-arbitrary-certificate-revocation-via-duplicate)
- [Netflix Lemur missing authorization check on POST /certificates/<id>/export](https://junglewise.ai/threats/cve-2026-71322-netflix-lemur-missing-authorization-check-on-post-certificates-id)
- [Netflix Lemur sub-CA creation authorization bypass](https://junglewise.ai/threats/cve-2026-71317-netflix-lemur-sub-ca-creation-authorization-bypass)
- [Netflix Lemur unchecked replaces authorization bypass](https://junglewise.ai/threats/cve-2026-71308-netflix-lemur-unchecked-replaces-authorization-bypass)
- [Netflix Lemur destinations API authorization bypass](https://junglewise.ai/threats/cve-2026-71307-netflix-lemur-destinations-api-authorization-bypass)