CVE-2026-44304 HIGH

CVE-2026-44304: Lemur: LDAP Filter Injection enables post-authentication privilege escalation

Vendor Netflix
Product lemur
Weakness CWE-90 · LDAP injection
Published May 12, 2026
Last update May 14, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.

Key dates

02Disclosure timeline

May 12, 2026 CVE published
May 14, 2026 Record updated