Executive brief
Lemur is an open-source certificate management system used by organizations to issue and manage TLS certificates. When configured to allow self-service CA creation (a supported configuration), any authenticated user can create intermediate certificate authorities chained to internal root CAs they have no permission to access, then use those intermediate CAs to issue trusted certificates for arbitrary domain names. This effectively converts a self-service test CA feature into unauthorized access to issue trusted certificates under any organization root, bypassing domain restrictions and audit controls.</brief> <parameter name="summary">Lemur is an open-source certificate management system used by organizations to issue and manage TLS certificates. When configured to allow self-service CA creation (a supported configuration), any authenticated user can create intermediate certificate authorities chained to internal root CAs they have no permission to access, then use those intermediate CAs to issue trusted certificates for arbitrary domain names. This effectively converts a self-service test CA feature into unauthorized access to issue trusted certificates under any organization root, bypassing domain restrictions and audit controls.
Technical details
The vulnerability is an authorization bypass in the sub-CA creation endpoint (`POST /api/1/authorities` with `type=subca`). When `ADMIN_ONLY_AUTHORITY_CREATION=False`, the endpoint validates that the caller holds global `AuthorityCreatorPermission` and `StrictRolePermission`, but fails to verify `AuthorityPermission` on the caller-supplied parent authority. The parent authority object is resolved by `AssociatedAuthoritySchema` via raw `fetch_objects()` lookup (no permission check), then passed directly to the issuer plugin which uses the parent's stored private key to sign the new intermediate. An authenticated non-read-only user can therefore mint a sub-CA chained to any internal root, assign themselves a role on it, and immediately issue certificates for arbitrary names, bypassing `LEMUR_ALLOWED_DOMAINS` and domain-authorization plugins. The precondition is an explicitly documented and supported configuration. A fix requires enforcing `AuthorityPermission(parent.id, parent.roles).can()` before invoking the issuer plugin.
Affected products
- Netflix Lemur <= 1.9.2
Timeline
- 2026-07-06: disclosed
- 2026-08-18: patched: v1.9.3 released with fix
- 2026-08-18: advisory