Description
Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authority_id, serial, or external_id without requiring permission on the underlying authority. PUT /api/1/certificates//revoke authorized the caller against only the selected Lemur row, so the creator of the duplicate bypassed CertificatePermission. The duplicate had no cert.endpoints, which also bypassed the safeguard that prevents revocation of deployed certificates. Issuer plugins then revoked the real CA-side certificate using certificate.body or external_id under the stored authority credentials. An attacker could therefore revoke arbitrary managed certificates and cause fleet-wide TLS denial of service. The fix rejects duplicate authority_id and serial identities, requires authority access on upload, and checks every matching row during revocation. This issue is fixed in version 1.9.3.
Published: 2026-08-18
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises when an authenticated user without read‑only status can POST a duplicate certificate record that bypasses authority checks, then PUT a revoke request that only validates against the duplicate entry. This allows the attacker to revoke the real CA‑side certificate, lifting it from all services that depend on it and effectively causing a fleet‑wide TLS denial of service. The flaw exploits a lack of ownership verification and endpoint validation during both upload and revocation.

Affected Systems

Netflix Lemur versions prior to 1.9.3, accessed via the /api/1/certificates/upload and /api/1/certificates/<id>/revoke endpoints.

Risk and Exploitability

With a CVSS score of 7.3 the issue is considered high severity. Exploitation is possible over the network from any authenticated non‑read‑only user who can reach the API; no special elevation or network privilege is required. The EPSS score is unavailable, but the CA‑side effect means the risk is significant. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on August 18, 2026 at 20:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Lemur to version 1.9.3 or later, which rejects duplicate authority_id and serial identities, requires authority access on upload, and checks all matching rows during revocation.
  • Enforce strict authorization on the certificate upload and revoke endpoints, ensuring that only users with explicit authority permissions can perform these actions.
  • Scan for and delete any existing duplicate certificate records that lack endpoints to prevent accidental revocation.

Generated by OpenCVE AI on August 18, 2026 at 20:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-pxmc-2ffp-8j67 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
History

Tue, 18 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Netflix
Netflix lemur
Vendors & Products Netflix
Netflix lemur

Tue, 18 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authority_id, serial, or external_id without requiring permission on the underlying authority. PUT /api/1/certificates//revoke authorized the caller against only the selected Lemur row, so the creator of the duplicate bypassed CertificatePermission. The duplicate had no cert.endpoints, which also bypassed the safeguard that prevents revocation of deployed certificates. Issuer plugins then revoked the real CA-side certificate using certificate.body or external_id under the stored authority credentials. An attacker could therefore revoke arbitrary managed certificates and cause fleet-wide TLS denial of service. The fix rejects duplicate authority_id and serial identities, requires authority access on upload, and checks every matching row during revocation. This issue is fixed in version 1.9.3.
Title Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H'}

Subscriptions

Netflix Lemur
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-18T19:47:43.931Z

Reserved: 2026-08-06T16:28:51.181Z

Link: CVE-2026-71417

cve-icon Vulnrichment

Updated: 2026-08-18T19:47:21.496Z

cve-icon NVD

Status : Received

Published: 2026-08-18T20:17:24.237

Modified: 2026-08-18T20:17:24.237

Link: CVE-2026-71417

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T21:00:04Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key