Netflix Lemur up to 1.9.2 Certificate Upload upload authority_id/serial/external_id privileges management

Summaryinfo

A vulnerability was found in Netflix Lemur up to 1.9.2 and classified as problematic. The impacted element is an unknown function of the file /api/1/certificates/upload of the component Certificate Upload. Executing a manipulation of the argument authority_id/serial/external_id can lead to privileges management. This vulnerability appears as CVE-2026-71417. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Netflix Lemur up to 1.9.2. It has been declared as problematic. This vulnerability affects an unknown code of the file /api/1/certificates/upload of the component Certificate Upload. The manipulation of the argument authority_id/serial/external_id with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect integrity, and availability. CVE summarizes:

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authority_id, serial, or external_id without requiring permission on the underlying authority. PUT /api/1/certificates//revoke authorized the caller against only the selected Lemur row, so the creator of the duplicate bypassed CertificatePermission. The duplicate had no cert.endpoints, which also bypassed the safeguard that prevents revocation of deployed certificates. Issuer plugins then revoked the real CA-side certificate using certificate.body or external_id under the stored authority credentials. An attacker could therefore revoke arbitrary managed certificates and cause fleet-wide TLS denial of service. The fix rejects duplicate authority_id and serial identities, requires authority access on upload, and checks every matching row during revocation. This issue is fixed in version 1.9.3.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-71417 since 08/06/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 1.9.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Netflix

Name

• Lemur

Version

• 1.9.0
• 1.9.1
• 1.9.2

Website

• Product: https://github.com/Netflix/lemur/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion