Description

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Because no before_update listener ran, administrator-initiated password changes through PUT /api/1/users/ were committed as plaintext. The affected user could no longer authenticate normally because bcrypt verification received an unhashed value. A database, backup, replica, query-log, or administrative read compromise exposed immediately usable credentials without offline cracking. The fix registers hashing for before_update and avoids rehashing values that already have a bcrypt prefix. This issue is fixed in version 1.9.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-18T19:16:58.493Z",
  "pubdate": "2026-08-18T19:16:58.493Z",
  "executiveSummary": "A cleartext password storage vulnerability exists in Netflix Lemur prior to version 1.9.2, specifically within the user management and database event listening mechanisms.\nThe vulnerability allows administrators to inadvertently overwrite user passwords with plaintext values during profile updates, completely bypassing the intended cryptographic hashing routines.\nImpact includes the exposure of immediately usable plaintext credentials in database storage, backups, replicas, and query logs, removing the need for offline brute-force cracking if the underlying data store is compromised.\nThe affected product is Lemur, with versions prior to 1.9.2 impacted.\nAttacker capabilities involve leveraging unauthorized or compromised administrative access, database read access, or log inspection to harvest plaintext credentials.\nExploitation requires an administrator to update a user's password through the PUT /api/1/users/ endpoint, or alternatively, an attacker with read access to the database or query logs to extract existing plaintext passwords.\nRisk implications are severe due to direct credential exposure, leading to unauthorized authentication and potential privilege escalation across systems dependent on Lemur.",
  "technicalDetails": "The vulnerability stems from improper handling of database lifecycle events within Lemur user management components.\nSpecifically, the vulnerable function lemur.users.service.update assigns a replacement password directly to users.password.\nConcurrently, lemur/users/models.py registers the hashing function User.hash_password exclusively for the SQLAlchemy before_insert event, omitting registration for the before_update event.\nConsequently, when an administrator initiates a password modification via the PUT /api/1/users/ endpoint, the updated password is committed directly to the database as plaintext rather than being processed by bcrypt.\nThe affected user is subsequently unable to authenticate normally because the authentication mechanism attempts bcrypt verification against an unhashed plaintext value.\nFrom an attack flow perspective, an adversary who achieves read compromise of the underlying database, database backups, read replicas, or database query logs is exposed to immediately usable credentials without requiring offline cracking techniques.\nThe vulnerable components include lemur.users.service.update and lemur/users/models.py across Lemur versions prior to 1.9.2.\nPrivilege requirements involve administrative privileges to trigger the plaintext password update via the API, or read access to storage layers to extract the compromised credentials.\nThe fixed implementation in version 1.9.2 registers password hashing for the before_update database event and incorporates conditional logic to avoid rehashing values that already possess a valid bcrypt prefix."
}