CVE-2026-44305

Description

Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disables TLS certificate verification at the global ldap module level. This allows a man-in-the-middle attacker positioned between Lemur and the LDAP server to intercept all authentication credentials. This vulnerability is fixed in 1.9.0.

PUBLISHED Reserved 2026-05-05 | Published 2026-05-12 | Updated 2026-05-13 | Assigner GitHub_M

Problem types

CWE-295: Improper Certificate Validation

Product status

References

github.com/.../lemur/security/advisories/GHSA-vr7c-r5gj-j3w5 exploit

github.com/.../lemur/security/advisories/GHSA-vr7c-r5gj-j3w5

cve.org (CVE-2026-44305)

nvd.nist.gov (CVE-2026-44305)

Download JSON