Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-71317: Lemur: Unauthorized users can create sub-certificates

CVE-2026-71317 · published 2 months ago

Summary

Lemur's certificate creation process had a flaw that allowed non-authorized users to create sub-certificates that could be used to issue trusted certificates. This could lead to unauthorized access and control of sensitive data. The issue has been fixed in version 1.9.3, so it's essential to update to the latest version to prevent this vulnerability.

What to do

Update the lemur developers lemur to version 1.9.3.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	netflix	lemur	< 1.9.3
PyPI	the lemur developers	lemur	< 1.9.3 Fix: upgrade to 1.9.3
pip	the lemur developers	lemur	<= 1.9.2 Fix: upgrade to 1.9.3

Original advisory text

Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMIN_ONLY_AUTHORITY_CREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority creation to cryptography-issuer, which used the parent authority_certificate.private_key to sign a new intermediate. Any authenticated non-read-only user in that supported configuration could chain a sub-CA to an internal root for which the user held no role. The resulting intermediate could issue trusted certificates and its private key could be used outside Lemur, bypassing normal issuance controls. The fix checks AuthorityPermission on every supplied parent before invoking the issuer. This issue is fixed in version 1.9.3.

References

https://github.com/Netflix/lemur/releases/tag/v1.9.3 URL
https://github.com/Netflix/lemur/security/advisories/GHSA-g7p5-89mh-248h Vendor Advisory
https://github.com/Netflix/lemur/commit/8669011203ca3dd89d9e39bab9ef6850eca723f9 Patch
https://github.com/advisories/GHSA-g7p5-89mh-248h
https://github.com/Netflix/lemur Product
https://pypi.org/project/lemur Product
https://nvd.nist.gov/vuln/detail/CVE-2026-71317 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71317... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published18 Aug 2026

Updated24 Oct 2026

First seen18 Aug 2026

Sources

CVE-2026-71317 · NVD

CVE-2026-71317 · MITRE

GHSA-g7p5-89mh-248h · GHSA

PYSEC-2026-3677 · OSV

CVE-2026-71317 · OSV

Track software like this

Free during beta