CVE-2026-44304

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44304", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T17:39:31.113Z", "datePublished": "2026-05-12T21:27:28.118Z", "dateUpdated": "2026-05-14T12:33:51.765Z"}, "containers": {"cna": {"title": "Lemur: LDAP Filter Injection enables post-authentication privilege escalation", "problemTypes": [{"descriptions": [{"cweId": "CWE-90", "lang": "en", "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Netflix/lemur/security/advisories/GHSA-3r34-vq8m-39gh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Netflix/lemur/security/advisories/GHSA-3r34-vq8m-39gh"}], "affected": [{"vendor": "Netflix", "product": "lemur", "versions": [{"version": "< 1.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T21:27:28.118Z"}, "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0."}], "source": {"advisory": "GHSA-3r34-vq8m-39gh", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-3r34-vq8m-39gh", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T12:33:48.858848Z", "id": "CVE-2026-44304", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T12:33:51.765Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44304", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T12:33:48.858848Z"}}}], "references": [{"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-3r34-vq8m-39gh", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T12:33:42.852Z"}}], "cna": {"title": "Lemur: LDAP Filter Injection enables post-authentication privilege escalation", "source": {"advisory": "GHSA-3r34-vq8m-39gh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Netflix", "product": "lemur", "versions": [{"status": "affected", "version": "< 1.9.0"}]}], "references": [{"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-3r34-vq8m-39gh", "name": "https://github.com/Netflix/lemur/security/advisories/GHSA-3r34-vq8m-39gh", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-90", "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T21:27:28.118Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44304", "state": "PUBLISHED", "dateUpdated": "2026-05-14T12:33:51.765Z", "dateReserved": "2026-05-05T17:39:31.113Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-12T21:27:28.118Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "lemur", "vendor": "Netflix", "versions": [{"status": "affected", "version": "< 1.9.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0."}, {"lang": "es", "value": "Lemur gestiona la creaci\u00f3n de certificados TLS. Antes de la versi\u00f3n 1.9.0, el m\u00f3dulo de autenticaci\u00f3n LDAP de Lemur (lemur/auth/ldap.py) construye filtros de b\u00fasqueda LDAP utilizando entrada de usuario no saneada a trav\u00e9s de la interpolaci\u00f3n de cadenas de Python. Un usuario LDAP autenticado puede inyectar metacaracteres de filtro LDAP a trav\u00e9s del campo de nombre de usuario para manipular consultas de pertenencia a grupos y escalar sus privilegios a administrador. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.9.0."}], "id": "CVE-2026-44304", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44304", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T12:33:48.858848Z", "version": "2.0.3"}}]}, "published": "2026-05-12T22:16:37.140", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Netflix/lemur/security/advisories/GHSA-3r34-vq8m-39gh"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Netflix/lemur/security/advisories/GHSA-3r34-vq8m-39gh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-90"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.9.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "lemur", "source": "cna", "vendor": "Netflix"}, "product": "lemur", "vendor": "netflix"}], "created": "2026-05-12T23:45:25.455197+00:00", "updated": "2026-05-13T00:00:16.061048+00:00", "vendors": ["netflix", "netflix$PRODUCT$lemur"]}