# CVE-2026-71417: Netflix Lemur arbitrary certificate revocation via duplicate upload

Source: https://junglewise.ai/threats/cve-2026-71417-netflix-lemur-arbitrary-certificate-revocation-via-duplicate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71417 · Severity: high · CVSS 7.3 · Published 2026-08-18

Netflix Lemur is a certificate management system that manages TLS certificates across an organization. An authenticated user with basic privileges can upload a duplicate certificate record and then revoke it, causing the underlying production certificate to be revoked at the issuing Certificate Authority (CA). This allows an attacker to disable HTTPS on any number of live services managed by the affected organization, resulting in widespread service outages.

Technologies: [lemur (PyPI)](https://junglewise.ai/threats/technologies/lemur). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-71417 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71417 being exploited in the wild.

**How severe is CVE-2026-71417?** High severity, with a CVSS score of 7.3, published 18 August 2026.

**Which products and versions are affected?** lemur (PyPI) <= 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.3.

**Is there a fix for CVE-2026-71417?** Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71417 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-71417?** Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lemur (PyPI): upgrade to 1.9.3 or later

  ```sh
  pip install "lemur>=1.9.3"
  ```


## Technical details

The vulnerability is a multi-step authorization bypass affecting certificate revocation. The `POST /api/1/certificates/upload` endpoint accepts user-supplied certificate body, authority ID, and external_id parameters with only basic role checks (no AuthorityPermission validation). The database lacks uniqueness constraints on certificate body and external_id, allowing duplicate rows to be created. When revoking via `PUT /api/1/certificates/<id>/revoke`, authorization logic checks if the caller is the row creator, bypassing CertificatePermission checks. Additionally, the endpoint-attached safety guard (preventing revocation of deployed certificates) only inspects the duplicate row's endpoints (empty), not the original. The revocation plugins then invoke the CA's revoke method using the caller-supplied body or external_id, effectively revoking the real production certificate. An attacker requires only basic (non-read-only) authentication and access to read the victim certificate details via the public API.

## Affected products

- Netflix Lemur <=1.9.2

## Identifiers

- CVE-2026-71417
- GHSA-pxmc-2ffp-8j67
- PYSEC-2026-3678

## Timeline

- 2026-07-06: disclosed
- 2026-08-18: advisory: GitHub advisory published
- 2026-08-18: patched: Patched in version 1.9.3

## References

- [https://api.github.com/users/maperu](https://api.github.com/users/maperu)
- [https://github.com/maperu](https://github.com/maperu)
- [https://api.github.com/users/maperu/gists%7B/gist_id%7D](https://api.github.com/users/maperu/gists%7B/gist_id%7D)
- [https://api.github.com/users/maperu/repos](https://api.github.com/users/maperu/repos)
- [https://avatars.githubusercontent.com/u/197666644?v=4](https://avatars.githubusercontent.com/u/197666644?v=4)
- [https://api.github.com/users/maperu/events%7B/privacy%7D](https://api.github.com/users/maperu/events%7B/privacy%7D)

## Related threats

- [Netflix Lemur missing authorization check on POST /certificates/<id>/export](https://junglewise.ai/threats/cve-2026-71322-netflix-lemur-missing-authorization-check-on-post-certificates-id)
- [Netflix Lemur sub-CA creation authorization bypass](https://junglewise.ai/threats/cve-2026-71317-netflix-lemur-sub-ca-creation-authorization-bypass)
- [Netflix Lemur unchecked replaces authorization bypass](https://junglewise.ai/threats/cve-2026-71308-netflix-lemur-unchecked-replaces-authorization-bypass)
- [Netflix Lemur destinations API authorization bypass](https://junglewise.ai/threats/cve-2026-71307-netflix-lemur-destinations-api-authorization-bypass)
- [Lemur ACME authority update endpoint SSRF via URL bypass](https://junglewise.ai/threats/cve-2026-71303-lemur-acme-authority-update-endpoint-ssrf-via-url-bypass)