A vulnerability in the user‑update API of Netflix Lemur causes password values to be saved in plaintext when administrators modify or set passwords. Because the hashing function is only applied on inserts and not on updates, the database retains cleartext passwords, which defeats bcrypt authentication and exposes the credentials immediately. The plaintext passwords can be read from any database backup, replica, query log, or administrative interface. Any Lemur release older than version 1.9.2 is susceptible. The fix in 1.9.2 adds a before_update listener that hashes new passwords and skips values already prefixed with a bcrypt marker, restoring proper credential protection.

All Netflix Lemur deployments running a version before 1.9.2 are affected. The vulnerability resides in the lemur.users.service.update functionality and applies to any user record updated via the PUT /​api/1/users/ endpoint. Administrators should verify their current Lemur version and plan an upgrade if they remain behind. The vulnerability is specific to the Lemur TLS certificate management service and does not affect other Netflix products. No other external systems are impacted beyond those that may hold copies of the Lemur database or its logs.

The CVSS score of 4.9 indicates a moderate severity for this vulnerability. Attackers cannot rely on external code execution; instead they need to obtain cleartext passwords that were recorded when admin users updated passwords via the PUT /​api/1/users/ endpoint. According to the description, if an attacker gains access to a Lemur database, backup, replica, query‑log or other administrative read channel, they can read these passwords instantly and use them without any offline cracking. The vulnerability is not currently listed in the CISA KEV catalog, and no EPSS score is available to quantify exploitation probability at this time.