Is CVE-2026-55165 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55165 being exploited in the wild.

How severe is CVE-2026-55165?

Medium severity, with a CVSS score of 4.8, published 18 August 2026.

Which products and versions are affected?

lemur (PyPI) < 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.2.

Is there a fix for CVE-2026-55165?

Yes. lemur (PyPI): upgrade to 1.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55165 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55165?

Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55165: Netflix Lemur improper JWT signature verification in auth service

Q: Which products and versions are affected?

lemur (PyPI) < 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.2.

Q: Is there a fix for CVE-2026-55165?

Yes. lemur (PyPI): upgrade to 1.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55165 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55165?

Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55165 · Severity: medium · CVSS 4.8 · Published 2026-08-18

Netflix Lemur, a service for managing TLS certificates, contains a security flaw in how it verifies user login tokens. The system incorrectly trusts the security algorithm specified by the user's token rather than enforcing its own standards. While currently difficult to exploit, this could allow an attacker to bypass security controls if other system secrets are leaked or if the system's security configuration is updated in the future.

Technologies: lemur (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55165 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55165 being exploited in the wild.
How severe is CVE-2026-55165?: Medium severity, with a CVSS score of 4.8, published 18 August 2026.
Which products and versions are affected?: lemur (PyPI) < 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.2.
Is there a fix for CVE-2026-55165?: Yes. lemur (PyPI): upgrade to 1.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55165 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55165?: Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lemur (PyPI): upgrade to 1.9.2 or later
```
pip install "lemur>=1.9.2"
```

Technical details

The vulnerability exists in `lemur/auth/service.py` where the JWT verifier extracts the `alg` header from an unverified token and passes it directly into the `algorithms` parameter of `pyjwt.decode()`. This is a classic JWT anti-pattern that allows an attacker to choose the validation algorithm. While PyJWT 2.x mitigates the `alg=none` attack by default, this flaw enables 'RS256 to HS256' algorithm confusion attacks if the deployment migrates to asymmetric signing. Additionally, it blinds audit logs by allowing attackers to spoof the algorithm recorded in telemetry. An attacker with knowledge of the `LEMUR_TOKEN_SECRET` (via a separate disclosure) can forge administrative tokens. The issue is addressed in version 1.9.2 by pinning the accepted algorithms in the server configuration.

Affected products

Netflix Lemur < 1.9.2

Identifiers

CVE-2026-55165
GHSA-r9gp-7f88-9r54
PYSEC-2026-2589

Timeline

2026-06-10: disclosed: Initial disclosure on GitHub
2026-06-25: patched: Version 1.9.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.