CVE-2026-44305: Netflix Lemur

Medium severity, CVSS 6.8. EPSS: 0.1% chance of exploitation in the next 30 days.

Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disables TLS certificate verification at the global ldap module level. This allows a man-in-the-middle attacker positioned between Lemur and the LDAP server to intercept all authentication credentials. This vulnerability is fixed in 1.9.0.

Affected products

• Netflix Lemur: before 1.9.0 (fixed in 1.9.0)

Published 2026-05-12. Last modified 2026-06-17.