CVE-2026-71317: Netflix Lemur sub-CA creation authorization bypass

CVE-2026-71317 · Severity: medium · CVSS 6.5 · Published 2026-08-18

Lemur is an open-source certificate management system used by organizations to issue and manage TLS certificates. When configured to allow self-service CA creation (a supported configuration), any authenticated user can create intermediate certificate authorities chained to internal root CAs they have no permission to access, then use those intermediate CAs to issue trusted certificates for arbitrary domain names. This effectively converts a self-service test CA feature into unauthorized access to issue trusted certificates under any organization root, bypassing domain restrictions and audit controls.</brief> <parameter name="summary">Lemur is an open-source certificate management system used by organizations to issue and manage TLS certificates. When configured to allow self-service CA creation (a supported configuration), any authenticated user can create intermediate certificate authorities chained to internal root CAs they have no permission to access, then use those intermediate CAs to issue trusted certificates for arbitrary domain names. This effectively converts a self-service test CA feature into unauthorized access to issue trusted certificates under any organization root, bypassing domain restrictions and audit controls.

Technologies: lemur (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-71317 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71317 being exploited in the wild.
How severe is CVE-2026-71317?
Medium severity, with a CVSS score of 6.5, published 18 August 2026.
Which products and versions are affected?
lemur (PyPI) <= 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.3.
Is there a fix for CVE-2026-71317?
Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71317 attacked?
It is attacked with local access.
Am I affected by CVE-2026-71317?
Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lemur (PyPI): upgrade to 1.9.3 or later
    pip install "lemur>=1.9.3"

Technical details

The vulnerability is an authorization bypass in the sub-CA creation endpoint (`POST /api/1/authorities` with `type=subca`). When `ADMIN_ONLY_AUTHORITY_CREATION=False`, the endpoint validates that the caller holds global `AuthorityCreatorPermission` and `StrictRolePermission`, but fails to verify `AuthorityPermission` on the caller-supplied parent authority. The parent authority object is resolved by `AssociatedAuthoritySchema` via raw `fetch_objects()` lookup (no permission check), then passed directly to the issuer plugin which uses the parent's stored private key to sign the new intermediate. An authenticated non-read-only user can therefore mint a sub-CA chained to any internal root, assign themselves a role on it, and immediately issue certificates for arbitrary names, bypassing `LEMUR_ALLOWED_DOMAINS` and domain-authorization plugins. The precondition is an explicitly documented and supported configuration. A fix requires enforcing `AuthorityPermission(parent.id, parent.roles).can()` before invoking the issuer plugin.

Affected products

  • Netflix Lemur <= 1.9.2

Identifiers

  • CVE-2026-71317
  • GHSA-g7p5-89mh-248h
  • PYSEC-2026-3677

Timeline

  • 2026-07-06: disclosed
  • 2026-08-18: patched: v1.9.3 released with fix
  • 2026-08-18: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.