Vulnerability · Published May 12, 2026 · Assigned by GitHub_M

CVE-2026-44305Lemur: LDAP TLS certificate verification globally disabled enables credential interception

Medium 6.8

In plain English

A medium-severity improper certificate validation in lemur from Netflix. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.1%top 96.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disables TLS certificate verification at the global ldap module level. This allows a man-in-the-middle attacker positioned between Lemur and the LDAP server to intercept all authentication credentials. This vulnerability is fixed in 1.9.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	lemur	1.9.0	GHSA-vr7c-r5gj-j3w5
PyPI	lemur	1.9.0	PYSEC-2026-2590

Affected products (as reported)

Vendor	Product	Versions
Netflix	lemur	< 1.9.0

Weakness: CWE-295 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/Netflix/lemur/security/advisories/GHSA-vr7c-r5gj-j3w5 x_refsource_CONFIRM