p PatchFirst

CVE-2026-44305

CVE-2026-44305 · Lemur: LDAP TLS certificate verification globally disabled enables credential interception

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disables TLS certificate verification at the global ldap module level. This allows a man-in-the-middle attacker positioned between Lemur and the LDAP server to intercept all authentication credentials. This vulnerability is fixed in 1.9.0.

CVSS 6.8 · Medium · EPSS 0.1% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • lemur

    Versions
    • < 1.9.0: Affected

    No fix published

  • lemur PyPI

    Versions
    • 0.11.0
    • 0.2.1
    • 0.8.0
    • 0.8.1
    • 0.9.0
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.7.0
    • 1.8.0
    • 1.8.1
    • 1.8.2
    Affected ranges
    • ECOSYSTEM: < 1.9.0

    Update to 1.9.0

Original sources

Check your server →