CVE-2026-44305: Lemur LDAP Information Disclosure Flaw

CVE-2026-44305 Overview

CVE-2026-44305 affects Netflix Lemur, an open-source tool that manages Transport Layer Security (TLS) certificate creation. Versions prior to 1.9.0 disable TLS certificate verification globally in the ldap module when LDAP_USE_TLS = True is configured. The flaw resides in Lemur's Lightweight Directory Access Protocol (LDAP) authentication module. An attacker positioned on the network path between Lemur and the LDAP server can intercept authentication credentials in cleartext after stripping or forging the TLS layer. The maintainers fixed the issue in version 1.9.0. The weakness is classified under CWE-295: Improper Certificate Validation.

Critical Impact
A network-adjacent attacker can perform a man-in-the-middle attack against Lemur's LDAP TLS channel and harvest every authentication credential submitted through the application.

Affected Products

Netflix Lemur versions prior to 1.9.0
Lemur deployments with LDAP_USE_TLS = True configured
Any downstream integration relying on Lemur's LDAP authentication module

Discovery Timeline

2026-05-12 - CVE-2026-44305 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44305

Vulnerability Analysis

Lemur's LDAP authentication module unconditionally disables TLS certificate verification at the global ldap module level when LDAP TLS is enabled. The setting propagates across every LDAP operation in the running process, not just the authentication bind. The client accepts any certificate presented by the server, including expired, self-signed, or attacker-controlled certificates. This collapses the trust assumptions of TLS and converts an encrypted channel into one that authenticates neither party.

An attacker who can intercept traffic between Lemur and the directory server can present a fraudulent certificate and proxy the LDAP bind. Lemur sends the user's distinguished name and password over the attacker-controlled session, exposing them in plaintext to the adversary. Because Lemur is itself a certificate authority orchestration tool, compromised operator credentials may grant downstream control over certificate issuance workflows.

Root Cause

The LDAP authentication code path sets a global option that disables TLS_REQCERT style verification. The configuration is applied at the module level rather than scoped to the individual connection, and no certificate authority bundle or hostname check is enforced. This pattern is the canonical [CWE-295] failure: TLS is initiated but the peer identity is never validated.

Attack Vector

Exploitation requires adjacent network access between Lemur and the LDAP server, such as a compromised switch, ARP spoofing on the same VLAN, or a malicious upstream router. The attacker proxies the LDAP TLS connection, presents any certificate, and Lemur completes the bind. Captured credentials can then be replayed against Active Directory, Entra ID, or any other identity store the LDAP server fronts. No user interaction or prior authentication is required.

No verified exploit code is publicly available. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-vr7c-r5gj-j3w5.

Detection Methods for CVE-2026-44305

Indicators of Compromise

Unexpected TLS certificates presented on the LDAP server hostname or IP that do not match the issuing internal certificate authority.
ARP table anomalies or duplicate MAC entries on subnets that carry Lemur-to-LDAP traffic.
LDAP bind events originating from Lemur followed by anomalous authentication activity using the same accounts from unrelated source addresses.

Detection Strategies

Inventory Lemur deployments and confirm the installed version against the 1.9.0 fix line.
Inspect Lemur configuration files for LDAP_USE_TLS = True combined with versions below 1.9.0.
Capture LDAP traffic at the network perimeter of the Lemur host and validate the server certificate chain matches the expected internal CA.

Monitoring Recommendations

Alert on LDAP authentication failures or bind anomalies correlated with Lemur service accounts.
Monitor certificate transparency logs and internal PKI for unexpected issuance tied to Lemur operator accounts.
Track new ARP, DHCP, or routing changes on segments hosting Lemur and the LDAP infrastructure.

How to Mitigate CVE-2026-44305

Immediate Actions Required

Upgrade Lemur to version 1.9.0 or later on all hosts where LDAP authentication is enabled.
Rotate credentials for any account that has authenticated to Lemur over LDAP since TLS was enabled.
Restrict network paths between Lemur and the LDAP server to dedicated, monitored segments until patching is complete.

Patch Information

The vulnerability is fixed in Lemur 1.9.0. Apply the upgrade per the GitHub Security Advisory GHSA-vr7c-r5gj-j3w5 and restart the Lemur service so the corrected LDAP module is loaded.

Workarounds

If immediate upgrade is not possible, disable LDAP authentication in Lemur and fall back to an alternative authentication provider.
Terminate the LDAP TLS session on a local trusted proxy that performs strict certificate validation, and route Lemur to that proxy over loopback.
Enforce IPsec or mutually authenticated tunnels between the Lemur host and the LDAP server to prevent on-path interception.

bash

# Configuration example: verify Lemur version and disable vulnerable LDAP path
pip show lemur | grep -i version
# If version < 1.9.0, upgrade:
pip install --upgrade 'lemur>=1.9.0'
# Temporary mitigation: disable LDAP in lemur.conf.py
# LDAP_AUTH = False