CVE-2026-71322: Netflix Lemur missing authorization check on POST /certificates/<id>/export

Executive brief

Lemur is an open-source certificate management and deployment platform used to manage TLS/SSL certificates across infrastructure. A flaw in the certificate export endpoint allows any logged-in user to export any certificate using plugins that don't require private keys (such as Java truststore), without proper ownership or role-based permission checks. While current risk is limited to public certificate data exposure, the structural defect is dangerous because future export plugins may unknowingly expose private keys. The audit log is also polluted with false key-access records, undermining security investigation capabilities.

Technical details

The vulnerability is a missing authorization check (CWE-862) in lemur/certificates/views.py:1573 in the CertificateExport handler. The entire ownership and role-based CertificatePermission check is nested inside an `if plugin.requires_key:` conditional block. When an export plugin sets requires_key = False (currently only JavaTruststoreExportPlugin), the authorization gate is skipped entirely and the handler proceeds directly to plugin.export() without verifying the caller owns the certificate or holds appropriate roles. The private_key is always passed to the plugin regardless of the requires_key flag. Exploitation requires only valid authentication (PR:L); any authenticated user can invoke POST /api/1/certificates/<id>/export with a requires_key=False plugin. The latent risk is severe: any future plugin author who implements requires_key=False but still reads cert.private_key will silently leak keys to any authenticated user, as the authorization invariant is held by a structurally distant view-layer conditional, not enforced at the plugin boundary. Patched in version 1.9.3 by lifting the authorization check out of the requires_key conditional.

Affected products

• Netflix Lemur < 1.9.3

Timeline

• 2026-07-06: disclosed: Initial GitHub Advisory publication
• 2026-08-18: advisory: Published to GitHub Advisory Database
• 2026-08-18: patched: Fixed in Netflix/lemur v1.9.3 (commit 5683bbe)

References

• https://api.github.com/users/sour-exploit
• https://github.com/sour-exploit
• https://api.github.com/users/sour-exploit/gists%7B/gist_id%7D
• https://api.github.com/users/sour-exploit/repos
• https://avatars.githubusercontent.com/u/288231323?v=4
• https://api.github.com/users/sour-exploit/events%7B/privacy%7D