Netflix Lemur up to 1.9.2 CertificateExport export private_key improper authentication

Summaryinfo

A vulnerability has been found in Netflix Lemur up to 1.9.2 and classified as problematic. The affected element is an unknown function of the file /api/1/certificates/export of the component CertificateExport. Performing a manipulation of the argument private_key results in improper authentication. This vulnerability is reported as CVE-2026-71322. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Netflix Lemur up to 1.9.2. It has been classified as problematic. This affects an unknown part of the file /api/1/certificates/export of the component CertificateExport. The manipulation of the argument private_key with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality. The summary by CVE is:

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false bypassed that check, and the handler still passed cert.private_key as an argument and recorded a key_view audit event. The bundled JavaTruststoreExportPlugin ignored the key, so the immediate exposure was limited to public certificate material and misleading audit entries, but a future plugin could have consumed the supplied key. The fix passes no private key to plugins that do not require one and confines ownership checks and key_view logging to actual private-key exports. This issue is fixed in version 1.9.3.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-71322 since 08/05/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.9.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Netflix

Name

• Lemur

Version

• 1.9.0
• 1.9.1
• 1.9.2

Website

• Product: https://github.com/Netflix/lemur/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion