CVE-2026-55164: Lemur Auth Bypass Vulnerability

CVE-2026-55164 Overview

CVE-2026-55164 affects Netflix Lemur, a TLS certificate management and orchestration service. Versions prior to 1.9.2 store administrator-initiated password changes in plaintext because the hash_password() routine is only wired to the SQLAlchemy before_insert event and never fires on updates. When an administrator issues PUT /api/1/users/, the replacement password is written directly to users.password without bcrypt hashing. The affected account can no longer authenticate because bcrypt verification receives an unhashed value, and any compromise of the database, backup, replica, or query log exposes usable credentials. The issue maps to CWE-256: Plaintext Storage of a Password and is fixed in Lemur 1.9.2.

Critical Impact
Administrator password resets are persisted in plaintext, exposing credentials to anyone with read access to the Lemur database or its backups.

Affected Products

Netflix Lemur versions prior to 1.9.2
Deployments exposing PUT /api/1/users/ for administrator password resets
Lemur database replicas, backups, and query logs holding user records

Discovery Timeline

2026-08-18 - CVE-2026-55164 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-55164

Vulnerability Analysis

Lemur registers its bcrypt hashing routine, User.hash_password, in lemur/users/models.py against the SQLAlchemy before_insert event only. New users created through the API receive hashed credentials. However, lemur.users.service.update assigns a replacement password value directly to the users.password column during administrator-driven resets. Because no before_update listener is registered, the ORM commits the raw string to the database. The affected user is then locked out because bcrypt comparison fails against an unhashed value.

Root Cause

The root cause is missing coverage of write paths for password hashing. hash_password() runs only on insert, so any subsequent update to users.password, including admin-driven resets, bypasses hashing entirely. This is a classic implementation gap tied to [CWE-256], where a security-critical transformation is enforced in one code path but omitted from an equivalent one.

Attack Vector

Exploitation requires high-privilege access, since only administrators can call PUT /api/1/users/ to trigger a password reset. The value of the flaw is not in the reset action itself but in the resulting plaintext at rest. A read-level compromise of the database, a stolen backup, a replica leak, a query log capture, or an administrative console viewer can extract credentials in cleartext without offline cracking. Credentials harvested this way can then be reused against other services if the affected user reuses passwords.

text

# Patch note from CHANGELOG.rst (Lemur 1.9.2)
1.9.2 - `2026-06-03`
- Fixed plaintext password storage on admin-driven password reset (GHSA-q437-g7fv-2jvv).
  hash_password() was only wired to the before_insert SQLAlchemy event; a
  before_update listener is now registered so bcrypt hashing is applied on
  every write to users.password. A guard against double-hashing pre-existing
  bcrypt values was added to User.hash_password().

Source: Netflix Lemur commit 221c6d7

Detection Methods for CVE-2026-55164

Indicators of Compromise

Rows in the users table where the password column does not begin with a bcrypt prefix such as $2a$, $2b$, or $2y$.
Users unable to authenticate immediately after an administrator-initiated password reset on Lemur versions prior to 1.9.2.
Presence of readable password strings in database backups, replica snapshots, or slow-query logs referencing users.password.

Detection Strategies

Query the Lemur database for users.password values that fail a bcrypt format regex and correlate with recent PUT /api/1/users/ activity in application logs.
Audit API access logs for administrator calls to the user update endpoint and match them against subsequent failed logins by the same account.
Review source control and deployment metadata to confirm the running Lemur version is 1.9.2 or later.

Monitoring Recommendations

Alert on any write to users.password that does not produce a bcrypt-formatted value, using database triggers or column-level constraints.
Continuously monitor administrative endpoints under /api/1/users/ for unusual reset volume or reset activity outside change windows.
Track access to Lemur database backups and replicas, and flag exports performed by non-service accounts.

How to Mitigate CVE-2026-55164

Immediate Actions Required

Upgrade Lemur to version 1.9.2 or later, which registers a before_update hashing listener and adds a guard against re-hashing existing bcrypt values.
Identify any user rows containing non-bcrypt values in users.password and force those users through a secure reset after upgrading.
Rotate credentials for any account whose password was set through the admin reset flow on a vulnerable version, and treat exposed database or backup copies as compromised.

Patch Information

The fix ships in Lemur 1.9.2. The version bump is applied in lemur/__about__.py from 1.9.0 to 1.9.2, and the hashing logic in lemur/users/models.py is updated so hash_password() runs on both before_insert and before_update while skipping values that already carry a bcrypt prefix. See the GitHub Security Advisory GHSA-q437-g7fv-2jvv and the v1.9.2 release notes for details.

Workarounds

Restrict access to the PUT /api/1/users/ endpoint to a minimal set of administrators until the upgrade is complete.
Direct users to change their own passwords through the self-service flow, which still uses the before_insert-covered path, rather than through administrator resets.
Tighten access controls and encryption on Lemur database backups, replicas, and query logs to reduce exposure of any plaintext residue.

bash

# Verify the running Lemur version and confirm the fix is deployed
pip show lemur | grep -i version
# Expected output on patched systems:
# Version: 1.9.2

# Scan for any non-bcrypt password values still present after upgrade
psql -d lemur -c "SELECT id, username FROM users WHERE password !~ '^\\\$2[aby]\\\$';"