Lemur, a TLS certificate management tool, had a flaw before version 1.9.0. When LDAP over TLS was activated, the LDAP authentication module disabled certificate verification at the global level, meaning the connection to the LDAP server was effectively untrusted. This allows an attacker who can position themselves between Lemur and the LDAP server to perform a man‑in‑the‑middle attack and capture all authentication credentials, potentially compromising user accounts and access control.

Netflix Lemur deployments using LDAP authentication with TLS and running any version prior to 1.9.0 are affected. The issue exists in all releases that employ the default LDAP module before the 1.9.0 fix.

The CVSS score of 6.8 indicates moderate severity. EPSS is not available, but the flaw permits credential theft if the attacker can observe traffic between Lemur and its LDAP server. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires control over the network path to the LDAP server and enabling of LDAP TLS in Lemur. Upgrading removes the problem.