An authenticated LDAP user can inject LDAP filter metacharacters through the username field used by Lemur’s authentication module. The unsanitized interpolation of the username into search filters allows manipulation of group membership queries, enabling the attacker to gain administrator privileges within the Lemur application. This flaw provides an immediate elevation of rights after the attacker has already authenticated, affecting confidentiality and integrity of the certificate management system.

Netflix Lemur, versions prior to 1.9.0. Any deployment of Lemur that has not applied the 1.9.0 release is vulnerable. The issue originates from the lemur/auth/ldap.py module, where LDAP search filters are constructed with user‑supplied input.

The CVSS score of 8.1 reflects high severity. Because the vulnerability requires a valid LDAP credential, the attack vector is post‑authentication; the attacker must already have network access to the LDAP server and valid credentials. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, indicating no confirmed public exploits yet. Nevertheless, the ability to elevate privileges after authentication means that a malicious user who can log in to LDAP can immediately assign themselves administrator rights to Lemur, allowing full control over TLS certificate creation and revocation.