Is CVE-2026-71417 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71417 being exploited in the wild.

How severe is CVE-2026-71417?

High severity, with a CVSS score of 7.3, published 18 August 2026.

Which products and versions are affected?

lemur (PyPI) <= 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.3.

Is there a fix for CVE-2026-71417?

Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71417 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-71417?

Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71417: Netflix Lemur arbitrary certificate revocation via duplicate upload

Q: Which products and versions are affected?

lemur (PyPI) <= 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.3.

Q: Is there a fix for CVE-2026-71417?

Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-71417 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-71417?

Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71417 · Severity: high · CVSS 7.3 · Published 2026-08-18

Netflix Lemur is a certificate management system that manages TLS certificates across an organization. An authenticated user with basic privileges can upload a duplicate certificate record and then revoke it, causing the underlying production certificate to be revoked at the issuing Certificate Authority (CA). This allows an attacker to disable HTTPS on any number of live services managed by the affected organization, resulting in widespread service outages.

Technologies: lemur (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-71417 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71417 being exploited in the wild.
How severe is CVE-2026-71417?: High severity, with a CVSS score of 7.3, published 18 August 2026.
Which products and versions are affected?: lemur (PyPI) <= 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.3.
Is there a fix for CVE-2026-71417?: Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71417 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-71417?: Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lemur (PyPI): upgrade to 1.9.3 or later
```
pip install "lemur>=1.9.3"
```

Technical details

The vulnerability is a multi-step authorization bypass affecting certificate revocation. The `POST /api/1/certificates/upload` endpoint accepts user-supplied certificate body, authority ID, and external_id parameters with only basic role checks (no AuthorityPermission validation). The database lacks uniqueness constraints on certificate body and external_id, allowing duplicate rows to be created. When revoking via `PUT /api/1/certificates/<id>/revoke`, authorization logic checks if the caller is the row creator, bypassing CertificatePermission checks. Additionally, the endpoint-attached safety guard (preventing revocation of deployed certificates) only inspects the duplicate row's endpoints (empty), not the original. The revocation plugins then invoke the CA's revoke method using the caller-supplied body or external_id, effectively revoking the real production certificate. An attacker requires only basic (non-read-only) authentication and access to read the victim certificate details via the public API.

Affected products

Netflix Lemur <=1.9.2

Identifiers

CVE-2026-71417
GHSA-pxmc-2ffp-8j67
PYSEC-2026-3678

Timeline

2026-07-06: disclosed
2026-08-18: advisory: GitHub advisory published
2026-08-18: patched: Patched in version 1.9.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.