CVE-2026-71322: Netflix Lemur missing authorization check on POST /certificates/<id>/export

CVE-2026-71322 · Severity: medium · CVSS 4.3 · Published 2026-08-18

Lemur is an open-source certificate management and deployment platform used to manage TLS/SSL certificates across infrastructure. A flaw in the certificate export endpoint allows any logged-in user to export any certificate using plugins that don't require private keys (such as Java truststore), without proper ownership or role-based permission checks. While current risk is limited to public certificate data exposure, the structural defect is dangerous because future export plugins may unknowingly expose private keys. The audit log is also polluted with false key-access records, undermining security investigation capabilities.

Technologies: lemur (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-71322 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71322 being exploited in the wild.
How severe is CVE-2026-71322?
Medium severity, with a CVSS score of 4.3, published 18 August 2026.
Which products and versions are affected?
lemur (PyPI) < 1.9.3, ECOSYSTEM:introduced=0,fixed=1.9.3.
Is there a fix for CVE-2026-71322?
Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71322 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-71322?
Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lemur (PyPI): upgrade to 1.9.3 or later
    pip install "lemur>=1.9.3"

Technical details

The vulnerability is a missing authorization check (CWE-862) in lemur/certificates/views.py:1573 in the CertificateExport handler. The entire ownership and role-based CertificatePermission check is nested inside an `if plugin.requires_key:` conditional block. When an export plugin sets requires_key = False (currently only JavaTruststoreExportPlugin), the authorization gate is skipped entirely and the handler proceeds directly to plugin.export() without verifying the caller owns the certificate or holds appropriate roles. The private_key is always passed to the plugin regardless of the requires_key flag. Exploitation requires only valid authentication (PR:L); any authenticated user can invoke POST /api/1/certificates/<id>/export with a requires_key=False plugin. The latent risk is severe: any future plugin author who implements requires_key=False but still reads cert.private_key will silently leak keys to any authenticated user, as the authorization invariant is held by a structurally distant view-layer conditional, not enforced at the plugin boundary. Patched in version 1.9.3 by lifting the authorization check out of the requires_key conditional.

Affected products

  • Netflix Lemur < 1.9.3

Identifiers

  • CVE-2026-71322
  • GHSA-4h97-p9wq-chqj
  • PYSEC-2026-3673

Timeline

  • 2026-07-06: disclosed: Initial GitHub Advisory publication
  • 2026-08-18: advisory: Published to GitHub Advisory Database
  • 2026-08-18: patched: Fixed in Netflix/lemur v1.9.3 (commit 5683bbe)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.