PT-2026-38301 · Lemur · Lemur

Published 2026-05-06 · Updated 2026-05-12 · CVE-2026-44305

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.0

Description When LDAP TLS is enabled via the LDAP USE TLS variable, the LDAP authentication module in the bind() function unconditionally disables TLS certificate verification at the global ldap module level. This occurs because ldap.set option() is used instead of an instance-level call, disabling verification for the entire Python process. Consequently, any certificate—including self-signed, expired, or revoked ones—is accepted without validation. This allows a man-in-the-middle attacker positioned between Lemur and the LDAP server to intercept authentication credentials, such as usernames and plaintext passwords, and modify LDAP responses to inject arbitrary group memberships.

Recommendations Update to version 1.9.0.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-44305

GHSA-VR7C-R5GJ-J3W5

Affected Products

Lemur

References · 7

• 🔥 https://github.com/Netflix/lemur/security/advisories/GHSA-vr7c-r5gj-j3w5 · Exploit
• https://osv.dev/vulnerability/GHSA-vr7c-r5gj-j3w5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44305 · Security Note
• https://github.com/Netflix/lemur/releases/tag/v1.9.0 · Note
• https://github.com/Netflix/lemur · Note
• https://t.me/CVEtracker/53562 · Telegram Post
• https://python-ldap.org/en/python-ldap-3.4.0/reference/ldap.html#tls-options · Note