CVE-2026-55164

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Because no before_update listener ran, administrator-initiated password changes through PUT /api/1/users/ were committed as plaintext. The affected user could no longer authenticate normally because bcrypt verification received an unhashed value. A database, backup, replica, query-log, or administrative read compromise exposed immediately usable credentials without offline cracking. The fix registers hashing for before_update and avoids rehashing values that already have a bcrypt prefix. This issue is fixed in version 1.9.2.

• CWE-256

• https://github.com/Netflix/lemur/commit/221c6d7275ac667bb8898ab48d2b96926a89c1c4
• https://github.com/Netflix/lemur/releases/tag/v1.9.2
• https://github.com/Netflix/lemur/security/advisories/GHSA-q437-g7fv-2jvv
• https://github.com/Netflix/lemur/security/advisories/GHSA-q437-g7fv-2jvv

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55153mchange-commons-java is a Java library of shared utility cla…7.1
• CVE-2026-55158Conflibot warns in advance when merging a pull request will …9.1
• CVE-2026-55159luci-app-adblock-fast a WebUI for fast, lightweight DNS-base…8.8
• CVE-2026-5516IBM WebSphere Application Server - Liberty 22.0.0.11 through…5.9
• CVE-2026-55162Lemur manages TLS certificate creation. Prior to 1.9.2, lemu…6.3
• CVE-2026-55163Lemur manages TLS certificate creation. Prior to 1.9.2, PUT …6.3
• CVE-2026-55165Lemur manages TLS certificate creation. Prior to 1.9.2, the …4.8
• CVE-2026-55166Lemur manages TLS certificate creation. Prior to 1.9.2, auth…9.9
• CVE-2026-55168Runtipi is a personal homeserver orchestrator. In 4.10.0 and…6.5
• CVE-2026-55170OpenFGA is an authorization/permission engine built for deve…5.4
• CVE-2026-55173WWBN AVideo is an open source video platform. Versions 29.0 …8.1
• CVE-2026-55175Spinnaker is an open source, multi-cloud continuous delivery…7.5