TI-2026-49980 Aliases CVE-2026-71322 GHSA-4h97-p9wq-chqj

Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

LOW 20CWE-862Published 2026-08-18 · Updated 2026-08-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false bypassed that check, and the handler still passed cert.private_key as an argument and recorded a key_view audit event. The bundled JavaTruststoreExportPlugin ignored the key, so the immediate exposure was limited to public certificate material and misleading audit entries, but a future plugin could have consumed the supplied key. The fix passes no private key to plugins that do not require one and confines ownership checks and key_view logging to actual private-key exports. This issue is fixed in version 1.9.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00234 14th percentileScored 2026-11-07

Fix Fixed lemur (Netflix): 1.9.3lemur (PyPI): 1.9.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Netflix	lemur	before 1.9.3	1.9.3	Patch available	CNA
—	lemur (PyPI)	before 1.9.3	1.9.3	Patch available	GHSA-4h97-p9wq-chqj

lemur VendorNetflix Affected before 1.9.3 Fixed in 1.9.3 Patch available CNA
lemur (PyPI) Vendor— Affected before 1.9.3 Fixed in 1.9.3 Patch available GHSA-4h97-p9wq-chqj

Remediation

Fix · CNA lemur (Netflix) Fixed in 1.9.3
Fix · GHSA-4h97-p9wq-chqj lemur (PyPI) Fixed in 1.9.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-71322
2026-10-03 Alias added: GHSA-4h97-p9wq-chqj

References

Other 4

TI-2024-04374 Path Traversal vulnerability via File Uploads in Genie CVSS 3.1CRITICAL 9.9
TI-2023-21044 Dispatch writes JWT tokens in error message CVSS 3.1CRITICAL 9.1
TI-2026-39854 Improper authorization in Netflix lemur CVSS 3.1CRITICAL 9.9
TI-2026-32272 Lemur: LDAP Filter Injection enables post-authentication privilege escalation CVSS 3.1HIGH 8.1
TI-2026-49966 Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates CVSS 3.1HIGH 8.1
TI-2026-49965 Missing authorization in Netflix lemur CVSS 3.1HIGH 7.7

See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences