What is CVE-2026-44304?

CVE-2026-44304 is a high-severity vulnerability in Netflix Lemur, classified under LDAP Injection. CVSS score: 8.1/10. Published 2026-05-12.

How severe is CVE-2026-44304?

High severity. CVSS v3 base score is 8.1 out of 10.

LDAP Injection in Netflix Lemur

CVE-2026-44304

Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.

EPSS: 0.002 (7.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Netflix Lemur — versions < 1.9.0

Weakness classification (CWE)

CWE-90 — LDAP Injection

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-44304?: CVE-2026-44304 is a high-severity vulnerability in Netflix Lemur, classified under LDAP Injection. CVSS score: 8.1/10. Published 2026-05-12.
How severe is CVE-2026-44304?: High severity. CVSS v3 base score is 8.1 out of 10.