# lemur (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/lemur Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/lemur.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in lemur (PyPI): 0 in the last 7 days and 13 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-71417, was published on 18 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 13 - All time: 19 (1 critical, 0 exploited in the wild) ## About lemur (PyPI) Lemur is a certificate management framework that acts as a broker for certificate authorities to streamline SSL/TLS certificate administration. ## Latest lemur (PyPI) vulnerabilities - [CVE-2026-71417: Netflix Lemur arbitrary certificate revocation via duplicate upload](https://junglewise.ai/threats/cve-2026-71417-netflix-lemur-arbitrary-certificate-revocation-via-duplicate) (high, CVSS 7.3, published 18 Aug 2026) - [CVE-2026-71322: Netflix Lemur missing authorization check on POST /certificates//export](https://junglewise.ai/threats/cve-2026-71322-netflix-lemur-missing-authorization-check-on-post-certificates-id) (medium, CVSS 4.3, published 18 Aug 2026) - [CVE-2026-71317: Netflix Lemur sub-CA creation authorization bypass](https://junglewise.ai/threats/cve-2026-71317-netflix-lemur-sub-ca-creation-authorization-bypass) (medium, CVSS 6.5, published 18 Aug 2026) - [CVE-2026-71308: Netflix Lemur unchecked replaces authorization bypass](https://junglewise.ai/threats/cve-2026-71308-netflix-lemur-unchecked-replaces-authorization-bypass) (high, CVSS 8.1, published 18 Aug 2026) - [CVE-2026-71307: Netflix Lemur destinations API authorization bypass](https://junglewise.ai/threats/cve-2026-71307-netflix-lemur-destinations-api-authorization-bypass) (high, CVSS 7.7, published 18 Aug 2026) - [CVE-2026-71303: Lemur ACME authority update endpoint SSRF via URL bypass](https://junglewise.ai/threats/cve-2026-71303-lemur-acme-authority-update-endpoint-ssrf-via-url-bypass) (high, CVSS 7.7, published 18 Aug 2026) - [CVE-2026-70666: Lemur server-side request forgery via ACME authority update](https://junglewise.ai/threats/cve-2026-70666-lemur-server-side-request-forgery-via-acme-authority-update) (high, CVSS 7.4, published 18 Aug 2026) - [CVE-2026-70667: Netflix Lemur SSRF in certificate revocation checking via redirects and DNS rebinding](https://junglewise.ai/threats/cve-2026-70667-netflix-lemur-ssrf-in-certificate-revocation-checking-via) (medium, CVSS 6.3, published 18 Aug 2026) - [CVE-2026-55166: Netflix Lemur SSRF and IDOR leading to AWS IAM and PKI compromise](https://junglewise.ai/threats/cve-2026-55166-netflix-lemur-ssrf-and-idor-leading-to-aws-iam-and-pki-compromise) (critical, CVSS 9.9, published 18 Aug 2026) - [CVE-2026-55165: Netflix Lemur improper JWT signature verification in auth service](https://junglewise.ai/threats/cve-2026-55165-netflix-lemur-improper-jwt-signature-verification-in-auth-service) (medium, CVSS 4.8, published 18 Aug 2026) - [CVE-2026-55164: Netflix Lemur plaintext password storage in user update service](https://junglewise.ai/threats/cve-2026-55164-netflix-lemur-plaintext-password-storage-in-user-update-service) (medium, CVSS 4.9, published 18 Aug 2026) - [CVE-2026-55163: Netflix Lemur privilege escalation in role management API](https://junglewise.ai/threats/cve-2026-55163-netflix-lemur-privilege-escalation-in-role-management-api) (medium, CVSS 6.3, published 18 Aug 2026) - [CVE-2026-55162: Netflix Lemur SSRF in certificate verification via CRL and OCSP URLs](https://junglewise.ai/threats/cve-2026-55162-netflix-lemur-ssrf-in-certificate-verification-via-crl-and-ocsp) (medium, CVSS 6.3, published 18 Aug 2026) - [CVE-2026-48508: Netflix Lemur authorization bypass in permission classes](https://junglewise.ai/threats/cve-2026-48508-netflix-lemur-authorization-bypass-in-permission-classes) (high, CVSS 8.8, published 25 Jun 2026) - [CVE-2026-44305: Netflix Lemur TLS certificate verification bypass in LDAP authentication](https://junglewise.ai/threats/cve-2026-44305-netflix-lemur-improper-certificate-validation-in-ldap) (medium, CVSS 6.8, published 12 May 2026) - [CVE-2026-44304: Netflix Lemur LDAP injection in authentication module](https://junglewise.ai/threats/cve-2026-44304-netflix-lemur-ldap-injection-in-ldap-authentication-module) (high, CVSS 8.1, published 12 May 2026) - [Duplicate Advisory: Lemur subject to insecure random generation](https://junglewise.ai/threats/duplicate-advisory-lemur-subject-to-insecure-random-generation-b6fd32e6) (low, CVSS 3.1, published 19 Apr 2023) - [CVE-2023-30797: Lemur subject to insecure random generation](https://junglewise.ai/threats/cve-2023-30797-lemur-subject-to-insecure-random-generation) (low, CVSS 3.1, published 19 Apr 2023) - [CVE-2015-7764: PYSEC-2017-50 - Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.](https://junglewise.ai/threats/cve-2015-7764-lemur-uses-static-iv-per-key) (low, CVSS 3.1, published 9 Aug 2017) ## Most severe lemur (PyPI) vulnerabilities - [CVE-2026-55166: Netflix Lemur SSRF and IDOR leading to AWS IAM and PKI compromise](https://junglewise.ai/threats/cve-2026-55166-netflix-lemur-ssrf-and-idor-leading-to-aws-iam-and-pki-compromise) (critical, CVSS 9.9, published 18 Aug 2026) - [CVE-2026-48508: Netflix Lemur authorization bypass in permission classes](https://junglewise.ai/threats/cve-2026-48508-netflix-lemur-authorization-bypass-in-permission-classes) (high, CVSS 8.8, published 25 Jun 2026) - [CVE-2026-71308: Netflix Lemur unchecked replaces authorization bypass](https://junglewise.ai/threats/cve-2026-71308-netflix-lemur-unchecked-replaces-authorization-bypass) (high, CVSS 8.1, published 18 Aug 2026) - [CVE-2026-44304: Netflix Lemur LDAP injection in authentication module](https://junglewise.ai/threats/cve-2026-44304-netflix-lemur-ldap-injection-in-ldap-authentication-module) (high, CVSS 8.1, published 12 May 2026) - [CVE-2026-71307: Netflix Lemur destinations API authorization bypass](https://junglewise.ai/threats/cve-2026-71307-netflix-lemur-destinations-api-authorization-bypass) (high, CVSS 7.7, published 18 Aug 2026) - [CVE-2026-71303: Lemur ACME authority update endpoint SSRF via URL bypass](https://junglewise.ai/threats/cve-2026-71303-lemur-acme-authority-update-endpoint-ssrf-via-url-bypass) (high, CVSS 7.7, published 18 Aug 2026) - [CVE-2026-70666: Lemur server-side request forgery via ACME authority update](https://junglewise.ai/threats/cve-2026-70666-lemur-server-side-request-forgery-via-acme-authority-update) (high, CVSS 7.4, published 18 Aug 2026) - [CVE-2026-71417: Netflix Lemur arbitrary certificate revocation via duplicate upload](https://junglewise.ai/threats/cve-2026-71417-netflix-lemur-arbitrary-certificate-revocation-via-duplicate) (high, CVSS 7.3, published 18 Aug 2026) - [CVE-2026-44305: Netflix Lemur TLS certificate verification bypass in LDAP authentication](https://junglewise.ai/threats/cve-2026-44305-netflix-lemur-improper-certificate-validation-in-ldap) (medium, CVSS 6.8, published 12 May 2026) - [CVE-2026-71317: Netflix Lemur sub-CA creation authorization bypass](https://junglewise.ai/threats/cve-2026-71317-netflix-lemur-sub-ca-creation-authorization-bypass) (medium, CVSS 6.5, published 18 Aug 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 13 | 1 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "lemur (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/lemur, 13 November 2026.