Security Flaw in Lemur TLS Certificate Management by Netflix

CVE-2026-55164

What is CVE-2026-55164?

The vulnerability in Lemur's management of user passwords allows for insecure password handling during administrator-initiated updates. Specifically, prior to version 1.9.2, the system allowed plaintext password storage due to a deficiency in the update listener functionality. As a consequence, any password changes made through the API were stored without encryption, enabling potential exposure of user credentials through common security breaches, such as database compromises. Administrators and users are strongly advised to update to version 1.9.2 to ensure that all passwords are hashed correctly, safeguarding against unauthorized access.

References