CVE-2026-55164
Received Received - Intake

Password Change Plaintext Exposure in Lemur

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Because no before_update listener ran, administrator-initiated password changes through PUT /api/1/users/ were committed as plaintext. The affected user could no longer authenticate normally because bcrypt verification received an unhashed value. A database, backup, replica, query-log, or administrative read compromise exposed immediately usable credentials without offline cracking. The fix registers hashing for before_update and avoids rehashing values that already have a bcrypt prefix. This issue is fixed in version 1.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-55164
EUVD
EUVD-2026-61150

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lemur lemur 1.9.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-256 The product stores a password in plaintext within resources such as memory or files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves plaintext password storage in Lemur when administrators change user passwords via the PUT /api/1/users/ endpoint. The system only hashed passwords during user creation (before_insert event) but not during updates. As a result, new passwords were stored unhashed, causing authentication failures and exposing credentials if databases or backups were compromised.

Detection Guidance

Check Lemur version with pip show lemur or grep version in __about__.py. Inspect database for plaintext passwords by querying users.password without bcrypt prefix. Review logs for PUT /api/1/users/ requests showing unhashed password assignments.

Impact Analysis

Users may be unable to log in because their passwords are stored as plaintext while the system expects hashed values. Attackers with database access could read plaintext passwords directly without cracking hashes. This affects all users whose passwords were changed by administrators before version 1.9.2.

Compliance Impact

This vulnerability likely violates compliance requirements for secure password storage (e.g., GDPR Article 32, HIPAA Security Rule) by failing to implement proper encryption or hashing for sensitive authentication data. It creates risks of unauthorized access and data breaches, which could lead to regulatory penalties.

Mitigation Strategies

Upgrade to Lemur 1.9.2 or later. Apply the before_update listener fix or call user.hash_password() in update() service. Run a one-time migration to rehash any existing plaintext passwords in the database.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55164. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart