# CVE-2026-71317: Netflix Lemur sub-CA creation authorization bypass

Source: https://junglewise.ai/threats/cve-2026-71317-netflix-lemur-sub-ca-creation-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71317 · Severity: medium · CVSS 6.5 · Published 2026-08-18

Lemur is an open-source certificate management system used by organizations to issue and manage TLS certificates. When configured to allow self-service CA creation (a supported configuration), any authenticated user can create intermediate certificate authorities chained to internal root CAs they have no permission to access, then use those intermediate CAs to issue trusted certificates for arbitrary domain names. This effectively converts a self-service test CA feature into unauthorized access to issue trusted certificates under any organization root, bypassing domain restrictions and audit controls.</brief>
<parameter name="summary">Lemur is an open-source certificate management system used by organizations to issue and manage TLS certificates. When configured to allow self-service CA creation (a supported configuration), any authenticated user can create intermediate certificate authorities chained to internal root CAs they have no permission to access, then use those intermediate CAs to issue trusted certificates for arbitrary domain names. This effectively converts a self-service test CA feature into unauthorized access to issue trusted certificates under any organization root, bypassing domain restrictions and audit controls.

Technologies: [lemur (PyPI)](https://junglewise.ai/threats/technologies/lemur). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-71317 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71317 being exploited in the wild.

**How severe is CVE-2026-71317?** Medium severity, with a CVSS score of 6.5, published 18 August 2026.

**Which products and versions are affected?** lemur (PyPI) <= 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.3.

**Is there a fix for CVE-2026-71317?** Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71317 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-71317?** Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lemur (PyPI): upgrade to 1.9.3 or later

  ```sh
  pip install "lemur>=1.9.3"
  ```


## Technical details

The vulnerability is an authorization bypass in the sub-CA creation endpoint (`POST /api/1/authorities` with `type=subca`). When `ADMIN_ONLY_AUTHORITY_CREATION=False`, the endpoint validates that the caller holds global `AuthorityCreatorPermission` and `StrictRolePermission`, but fails to verify `AuthorityPermission` on the caller-supplied parent authority. The parent authority object is resolved by `AssociatedAuthoritySchema` via raw `fetch_objects()` lookup (no permission check), then passed directly to the issuer plugin which uses the parent's stored private key to sign the new intermediate. An authenticated non-read-only user can therefore mint a sub-CA chained to any internal root, assign themselves a role on it, and immediately issue certificates for arbitrary names, bypassing `LEMUR_ALLOWED_DOMAINS` and domain-authorization plugins. The precondition is an explicitly documented and supported configuration. A fix requires enforcing `AuthorityPermission(parent.id, parent.roles).can()` before invoking the issuer plugin.

## Affected products

- Netflix Lemur <= 1.9.2

## Identifiers

- CVE-2026-71317
- GHSA-g7p5-89mh-248h
- PYSEC-2026-3677

## Timeline

- 2026-07-06: disclosed
- 2026-08-18: patched: v1.9.3 released with fix
- 2026-08-18: advisory

## References

- [https://api.github.com/users/maperu](https://api.github.com/users/maperu)
- [https://github.com/maperu](https://github.com/maperu)
- [https://api.github.com/users/maperu/gists%7B/gist_id%7D](https://api.github.com/users/maperu/gists%7B/gist_id%7D)
- [https://api.github.com/users/maperu/repos](https://api.github.com/users/maperu/repos)
- [https://avatars.githubusercontent.com/u/197666644?v=4](https://avatars.githubusercontent.com/u/197666644?v=4)
- [https://api.github.com/users/maperu/events%7B/privacy%7D](https://api.github.com/users/maperu/events%7B/privacy%7D)

## Related threats

- [Netflix Lemur arbitrary certificate revocation via duplicate upload](https://junglewise.ai/threats/cve-2026-71417-netflix-lemur-arbitrary-certificate-revocation-via-duplicate)
- [Netflix Lemur missing authorization check on POST /certificates/<id>/export](https://junglewise.ai/threats/cve-2026-71322-netflix-lemur-missing-authorization-check-on-post-certificates-id)
- [Netflix Lemur unchecked replaces authorization bypass](https://junglewise.ai/threats/cve-2026-71308-netflix-lemur-unchecked-replaces-authorization-bypass)
- [Netflix Lemur destinations API authorization bypass](https://junglewise.ai/threats/cve-2026-71307-netflix-lemur-destinations-api-authorization-bypass)
- [Lemur ACME authority update endpoint SSRF via URL bypass](https://junglewise.ai/threats/cve-2026-71303-lemur-acme-authority-update-endpoint-ssrf-via-url-bypass)