CVE-2026-71308: Netflix Lemur unchecked replaces authorization bypass

CVE-2026-71308 · Severity: high · CVSS 8.1 · Published 2026-08-18

Netflix Lemur is a certificate lifecycle management platform that automates the issuance, rotation, and deployment of TLS certificates across production infrastructure. An authenticated attacker with any non-read-only role can upload a malicious certificate referencing arbitrary production certificates in a `replaces` array without authorization checks. This immediately disables expiration notifications and auto-renewal for victim certificates, then automatically deploys the attacker's certificate to all production endpoints (load balancers, Kubernetes clusters, etc.) during the next scheduled rotation cycle, while silently detaching the legitimate certificate.

Technologies: lemur (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-71308 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71308 being exploited in the wild.
How severe is CVE-2026-71308?
High severity, with a CVSS score of 8.1, published 18 August 2026.
Which products and versions are affected?
lemur (PyPI) >= 0.5.0, <= 1.9.2, ECOSYSTEM:introduced=0.5.0,fixed=1.9.3.
Is there a fix for CVE-2026-71308?
Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71308 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-71308?
Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lemur (PyPI): upgrade to 1.9.3 or later
    pip install "lemur>=1.9.3"

Technical details

The vulnerability is a privilege-escalation / authorization-bypass in the certificate creation and upload endpoints (`POST /api/1/certificates`, `POST /api/1/certificates/upload`, `PUT /api/1/certificates/<id>`). The `replaces[]` array parameter is accepted via `AssociatedCertificateSchema`, which calls `fetch_objects(Certificate, data)` to resolve certificate IDs to ORM objects without enforcing any `CertificatePermission` check. The SQLAlchemy append listener for `Certificate.replaces` then immediately mutates the victim certificate's `notify` field to `False` and populates `victim.replaced`, triggering side effects. Subsequent calls to `get_all_pending_reissue()` exclude the victim certificate, and the periodic `certificate_rotate` Celery task unconditionally deploys the attacker's certificate (`endpoint.certificate.replaced[0]`) to all endpoints via the deployment plugin (AWS ELB/CloudFront/ACM, Kubernetes, SFTP). The direct revoke endpoint enforces the same `CertificatePermission` check, but this path bypasses it entirely. Attack requires network access to the Lemur API and an authenticated token with any role except read-only; no user interaction is required. Patch v1.9.3 is available.

Affected products

  • Netflix Lemur >=0.5.0, <1.9.3

Identifiers

  • CVE-2026-71308
  • GHSA-cfh6-pv5c-38jv
  • PYSEC-2026-3675

Timeline

  • 2026-07-06: disclosed: Published to Netflix/lemur repository
  • 2026-08-18: advisory: Published to GitHub Advisory Database
  • 2026-08-18: patched: Lemur v1.9.3 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.