Is CVE-2026-48508 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48508 being exploited in the wild.

How severe is CVE-2026-48508?

High severity, with a CVSS score of 8.8, published 25 June 2026.

Which products and versions are affected?

lemur (PyPI) <= 1.9.0, ECOSYSTEM:introduced=0,fixed=1.9.1.

Is there a fix for CVE-2026-48508?

Yes. lemur (PyPI): upgrade to 1.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48508 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48508?

Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48508: Netflix Lemur authorization bypass in permission classes

Q: Which products and versions are affected?

lemur (PyPI) <= 1.9.0, ECOSYSTEM:introduced=0,fixed=1.9.1.

Q: Is there a fix for CVE-2026-48508?

Yes. lemur (PyPI): upgrade to 1.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48508 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-48508?

Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48508 · Severity: high · CVSS 8.8 · Published 2026-06-25

Netflix Lemur, a certificate management framework, contains a flaw where certain security checks were disabled by default. This allows any logged-in user, even those with "read-only" access, to perform administrative actions such as creating root Certificate Authorities, uploading certificates, and modifying system notifications. An attacker could use this to issue fraudulent certificates or gain control over the organization's digital trust infrastructure.

Technologies: lemur (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-48508 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48508 being exploited in the wild.
How severe is CVE-2026-48508?: High severity, with a CVSS score of 8.8, published 25 June 2026.
Which products and versions are affected?: lemur (PyPI) <= 1.9.0, ECOSYSTEM:introduced=0,fixed=1.9.1.
Is there a fix for CVE-2026-48508?: Yes. lemur (PyPI): upgrade to 1.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48508 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48508?: Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lemur (PyPI): upgrade to 1.9.1 or later
```
pip install "lemur>=1.9.1"
```

Technical details

An authorization bypass exists in Lemur's 'StrictRolePermission' and 'AuthorityCreatorPermission' classes within 'lemur/auth/permissions.py'. These classes utilize Flask-Principal for access control; however, when specific configuration flags (ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT) are unset or False, the permission objects are initialized with an empty set of 'Needs'. Because Flask-Principal's 'Permission.allows()' returns True for empty requirement sets, any authenticated user—including those with the 'read-only' role—can bypass authorization gates on critical API endpoints. This allows unauthorized creation of root CAs, certificate uploads, and modification of notification settings (which can lead to SSRF). The vulnerability is remediated in version 1.9.1 by changing the default value of these configuration flags to True.

Affected products

Netflix Lemur <= 1.9.0

Identifiers

CVE-2026-48508
GHSA-qcqw-jwxc-2hqg
PYSEC-2026-2588

Timeline

2026-05-28: disclosed: Vulnerability reported to vendor
2026-06-25: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.