CVE-2026-44304CWE-90

Lemur: LDAP Filter Injection enables post-authentication privilege escalation

High · published May 12, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00288 · 20.2th percentile
Weakness
CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published
2026-05-12T21:27Z
EPSS history
Timeline
  • 12 MAY 21:27Z
    Lemur: LDAP Filter Injection enables post-authentication privilege escalation
    cvelistv5