Executive brief
Netflix Lemur is a certificate management system that manages TLS certificates across an organization. An authenticated user with basic privileges can upload a duplicate certificate record and then revoke it, causing the underlying production certificate to be revoked at the issuing Certificate Authority (CA). This allows an attacker to disable HTTPS on any number of live services managed by the affected organization, resulting in widespread service outages.
Technical details
The vulnerability is a multi-step authorization bypass affecting certificate revocation. The `POST /api/1/certificates/upload` endpoint accepts user-supplied certificate body, authority ID, and external_id parameters with only basic role checks (no AuthorityPermission validation). The database lacks uniqueness constraints on certificate body and external_id, allowing duplicate rows to be created. When revoking via `PUT /api/1/certificates/<id>/revoke`, authorization logic checks if the caller is the row creator, bypassing CertificatePermission checks. Additionally, the endpoint-attached safety guard (preventing revocation of deployed certificates) only inspects the duplicate row's endpoints (empty), not the original. The revocation plugins then invoke the CA's revoke method using the caller-supplied body or external_id, effectively revoking the real production certificate. An attacker requires only basic (non-read-only) authentication and access to read the victim certificate details via the public API.
Affected products
- Netflix Lemur <=1.9.2
Timeline
- 2026-07-06: disclosed
- 2026-08-18: advisory: GitHub advisory published
- 2026-08-18: patched: Patched in version 1.9.3