CVE-2026-44304 Lemur: LDAP Filter Injection enables post-authentication privilege escalation
Authenticated users can inject LDAP filters via username to escalate privileges to administrator in Lemur certificate management.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44304?
CVE-2026-44304 is a high-severity vulnerability in Netflix lemur, published on 12 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.
Weakness: CWE-90
Which versions are affected by CVE-2026-44304?
3 open source packages ship an affected version, including lemur.
| Package | Affected | Fixed in |
|---|---|---|
lemur PyPI | All versions | 1.9.0 |
lemur PyPI | All versions | 1.9.0 |
lemur PyPI | All versions | 1.9.0 |
How do I fix CVE-2026-44304?
Upgrade lemur to 1.9.0 or later.
Is CVE-2026-44304 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44304 exists.
Sources
Also known as GHSA-3r34-vq8m-39gh, PYSEC-2026-2585.