CVE-2026-55164

The record

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Because no before_update listener ran, administrator-initiated password changes through PUT /api/1/users/ were committed as plaintext. The affected user could no longer authenticate normally because bcrypt verification received an unhashed value. A database, backup, replica, query-log, or administrative read compromise exposed immediately usable credentials without offline cracking. The fix registers hashing for before_update and avoids rehashing values that already have a bcrypt prefix. This issue is fixed in version 1.9.2.

Affected packages

Related vulnerabilities

• CVE-2026-19051 Plaintext storage of a password vulnerability in Menulux Software Inc. CWE-256
• CVE-2026-15933 OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. CWE-256
• CVE-2021-38489 HDD password plaintext is stored in a UEFI variable. CWE-256
• CVE-2026-14867 Credentials of built-in users are insecurely stored in the User directory of PcVue… CWE-256
• CVE-2026-57302 Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml… CWE-256
• CVE-2026-50268 Steeltoe is an open source project that provides a collection of libraries that helps… CWE-256
• CVE-2024-39575 update_disk_psu_baseline.sh requires password in plain text CWE-256
• CVE-2024-45636 IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which… CWE-256