The vulnerability arises from a missing ownership verification on the POST /certificates/<id>/export route when a plugin declares requires_key=false. Under this configuration, the private key is still passed to the plugin and a key_view audit event is logged, allowing the plugin to potentially receive the private key even though it is not required. The current bundled JavaTruststoreExportPlugin ignores the key, so the immediate exposure is limited to public certificate material and misleading audit logs, but future plugins could exploit the supplied key, leading to disclosure of sensitive certificate secrets.

Netflix Lemur deployments running any version prior to 1.9.3 are affected. The issue is present in all 1.0.0 through 1.9.2 releases and is fixed in release 1.9.3, which correctly constrains the private key export to plugins that explicitly require it.

The CVSS score of 4.3 indicates a moderate risk. With no EPSS data and the vulnerability not listed in KEV, the likelihood of immediate exploitation remains uncertain. However, an authenticated user who can trigger the export endpoint and who has a controllable plugin configured with requires_key=false could obtain the private key. The lack of an authentication check for the key export path or proper plugin authorization makes the attack vector likely via an internal API call rather than through the web UI.