CVEvulnerability

CVE-2026-44304

8.1 HIGH Published 2026-05-12 Modified 2026-10-26 Official page ↗
Status
Deferred
Published
2026-05-12
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-90

Description

Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.

Related

Weakness · CWE (1)

  • CWE-90 Improper Neutralization of Special Elements used in an LDAP Query weakness

References