CVE-2026-44304 | Netflix lemur up to 1.8.x lemur/auth/ldap.py Username ldap injection (GHSA-3r34-vq8m-39gh)

A vulnerability classified as critical was found in Netflix lemur up to 1.8.x. This affects an unknown function of the file lemur/auth/ldap.py. The manipulation of the argument Username results in ldap injection.

This vulnerability is identified as CVE-2026-44304. The attack can be executed remotely. There is not any exploit available.

Upgrading the affected component is advised.