Executive brief
Netflix Lemur is a certificate lifecycle management platform that automates the issuance, rotation, and deployment of TLS certificates across production infrastructure. An authenticated attacker with any non-read-only role can upload a malicious certificate referencing arbitrary production certificates in a `replaces` array without authorization checks. This immediately disables expiration notifications and auto-renewal for victim certificates, then automatically deploys the attacker's certificate to all production endpoints (load balancers, Kubernetes clusters, etc.) during the next scheduled rotation cycle, while silently detaching the legitimate certificate.
Technical details
The vulnerability is a privilege-escalation / authorization-bypass in the certificate creation and upload endpoints (`POST /api/1/certificates`, `POST /api/1/certificates/upload`, `PUT /api/1/certificates/<id>`). The `replaces[]` array parameter is accepted via `AssociatedCertificateSchema`, which calls `fetch_objects(Certificate, data)` to resolve certificate IDs to ORM objects without enforcing any `CertificatePermission` check. The SQLAlchemy append listener for `Certificate.replaces` then immediately mutates the victim certificate's `notify` field to `False` and populates `victim.replaced`, triggering side effects. Subsequent calls to `get_all_pending_reissue()` exclude the victim certificate, and the periodic `certificate_rotate` Celery task unconditionally deploys the attacker's certificate (`endpoint.certificate.replaced[0]`) to all endpoints via the deployment plugin (AWS ELB/CloudFront/ACM, Kubernetes, SFTP). The direct revoke endpoint enforces the same `CertificatePermission` check, but this path bypasses it entirely. Attack requires network access to the Lemur API and an authenticated token with any role except read-only; no user interaction is required. Patch v1.9.3 is available.
Affected products
- Netflix Lemur >=0.5.0, <1.9.3
Timeline
- 2026-07-06: disclosed: Published to Netflix/lemur repository
- 2026-08-18: advisory: Published to GitHub Advisory Database
- 2026-08-18: patched: Lemur v1.9.3 released with fix