CVE-2026-44305 Lemur: LDAP TLS certificate verification globally disabled enables credential interception
Man-in-the-middle attackers can intercept authentication credentials when LDAP TLS is enabled due to disabled certificate verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44305?
CVE-2026-44305 is a medium-severity vulnerability in Netflix lemur, published on 12 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disables TLS certificate verification at the global ldap module level. This allows a man-in-the-middle attacker positioned between Lemur and the LDAP server to intercept all authentication credentials. This vulnerability is fixed in 1.9.0.
Weakness: CWE-295
Which versions are affected by CVE-2026-44305?
3 open source packages ship an affected version, including lemur.
| Package | Affected | Fixed in |
|---|---|---|
lemur PyPI | All versions | 1.9.0 |
lemur PyPI | All versions | 1.9.0 |
lemur PyPI | All versions | 1.9.0 |
How do I fix CVE-2026-44305?
Upgrade lemur to 1.9.0 or later.
Is CVE-2026-44305 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44305 exists.
Sources
Also known as GHSA-vr7c-r5gj-j3w5, PYSEC-2026-2590.