CVE-2026-44304

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44304
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44304.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44304
Aliases
Published
2026-05-12T21:27:28.118Z
Modified
2026-07-15T01:49:18.286118659Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Lemur: LDAP Filter Injection enables post-authentication privilege escalation
Details

Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44304.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-90"
    ]
}
References

Affected packages

Git / github.com/netflix/lemur

Affected ranges

Type
GIT
Repo
https://github.com/netflix/lemur
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f59087a51b986595af49c7e1bc89913632c0d625
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.9.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1
0.1.2
0.1.3
0.1.4
0.1.5
0.2
0.2.1
0.2.2
0.3.0
0.4.0
0.5.0
0.6.0
0.7.0
0.8.0
v0.*
v0.10.0
v0.11.0
v0.8.1
v0.9.0
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.8.1
v1.8.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44304.json"