CVE-2026-44304

The record

Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.

Affected packages

Related vulnerabilities

• CVE-2026-15723 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before… CWE-90
• CVE-2026-80055 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-90
• CVE-2026-75020 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')… CWE-90
• CVE-2026-19271 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')… CWE-90
• CVE-2026-76373 In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with… CWE-90
• CVE-2026-19930 A security flaw has been discovered in Dolibarr up to 23.0.3. CWE-90
• CVE-2026-74241 A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP)… CWE-90
• CVE-2026-16071 A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user… CWE-90