Netflix Lemur CVE-2026-44304

Requires valid LDAP credentials (username and password) for initial authentication-the LDAP simple_bind_s() call must succeed before the vulnerable filter code is reached, making this strictly post-authentication privilege escalation (CVSS PR:L). Lemur deployment must have LDAP authentication explicitly enabled via LDAP_AUTH = True configuration parameter. The vulnerability is exploitable against both standalone LDAP servers and Active Directory LDAP configurations (LDAP_IS_ACTIVE_DIRECTORY = True). Attack is remotely exploitable over the network (AV:N) against the /auth/login HTTP endpoint with low complexity (AC:L) requiring no user interaction (UI:N). Exploitation does NOT require administrator credentials, non-default configurations beyond enabling LDAP authentication, or special product features-default LDAP integration using the vulnerable lemur/auth/ldap.py module is sufficient. The vulnerability exists in the code path executed during normal LDAP authentication flows when constructing user lookup and group membership queries.

Real-world risk is HIGH for organizations using Lemur with LDAP authentication enabled. The CVSS 8.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects network-exploitability by low-privileged authenticated users with no user interaction required, though the PR:L (low privileges required) qualifier is critical-attackers need valid LDAP credentials first, making this post-authentication privilege escalation rather than initial access. Attack complexity is LOW because exploitation requires only crafting a malicious username string with LDAP metacharacters. The confidentiality and integrity impact is HIGH (access to all private keys and certificate issuance capabilities), while availability impact is NONE. EPSS data not provided, but risk signals converge: vendor-confirmed vulnerability with detailed reproduction steps in GitHub security advisory, specific vulnerable code locations identified, and concrete exploitation constraints documented. The vulnerability's severity is amplified in certificate management contexts where Lemur controls cryptographic trust infrastructure-successful exploitation grants attackers capability to issue fraudulent certificates under any authority, intercept TLS communications, or extract private keys for sensitive certificates. Mitigating factor: requires LDAP authentication to be enabled (LDAP_AUTH = True) and attacker must possess valid credentials, limiting exposure to insider threats or scenarios where attackers have already compromised low-privilege LDAP accounts. Organizations not using LDAP authentication are not affected. SSVC exploitation status: publicly known method with proof-of-concept reproduction steps, automatable given valid credentials, technical impact is TOTAL (admin privileges), suggesting Priority 1 patching for affected deployments.

An attacker with valid low-privilege LDAP credentials (e.g., a compromised employee account or contractor with basic domain access) authenticates to a Lemur instance deployed with LDAP integration. During login at POST /auth/login, the attacker submits a crafted username containing LDAP filter metacharacters such as 'validuser)(memberOf=CN=LemurAdmins,DC=corp,DC=example,DC=com'. This injection manipulates the LDAP group membership query to falsely return that the attacker belongs to the LemurAdmins group, causing Lemur to assign administrator privileges. The attacker then accesses /certificates/<id>/key endpoints to exfiltrate private keys for production TLS certificates or issues fraudulent certificates under the organization's certificate authorities, enabling man-in-the-middle attacks against internal or customer-facing services.