Netflix Lemur up to 1.9.2 Authority Permission /api/1/authorities privileges management

Summaryinfo

A vulnerability labeled as problematic has been found in Netflix Lemur up to 1.9.2. Affected is an unknown function of the file /api/1/authorities of the component Authority Permission. Such manipulation leads to privileges management. This vulnerability is referenced as CVE-2026-71317. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Netflix Lemur up to 1.9.2. It has been rated as problematic. Affected by this issue is an unknown part of the file /api/1/authorities of the component Authority Permission. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is integrity. CVE summarizes:

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMIN_ONLY_AUTHORITY_CREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority creation to cryptography-issuer, which used the parent authority_certificate.private_key to sign a new intermediate. Any authenticated non-read-only user in that supported configuration could chain a sub-CA to an internal root for which the user held no role. The resulting intermediate could issue trusted certificates and its private key could be used outside Lemur, bypassing normal issuance controls. The fix checks AuthorityPermission on every supplied parent before invoking the issuer. This issue is fixed in version 1.9.3.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-71317 since 08/05/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 1.9.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Netflix

Name

• Lemur

Version

• 1.9.0
• 1.9.1
• 1.9.2

Website

• Product: https://github.com/Netflix/lemur/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion