CVE-2026-71322
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Description
Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false bypassed that check, and the handler still passed cert.private_key as an argument and recorded a key_view audit event. The bundled JavaTruststoreExportPlugin ignored the key, so the immediate exposure was limited to public certificate material and misleading audit entries, but a future plugin could have consumed the supplied key. The fix passes no private key to plugins that do not require one and confines ownership checks and key_view logging to actual private-key exports. This issue is fixed in version 1.9.3.
INFO
Published Date :
Aug. 18, 2026, 8:17 p.m.
Last Modified :
Oct. 22, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE |
Solution
- Update Lemur to version 1.9.3 or later.
- Ensure plugins correctly handle private keys.
- Review audit logs for unusual key_view events.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-71322.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-71322 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-71322
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-71322 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-71322 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 22, 2026
Action Type Old Value New Value Added Translation Title: lemur de Netflix, Description: Lemur gestiona la creación de certificados TLS. Antes de la versión 1.9.3, CertificateExport colocaba su verificación de propiedad de CertificatePermission dentro de la rama plugin.requires_key para POST /api/1/certificates//export. Un plugin que declaraba requires_key como falso eludía esa verificación, y el gestor aún pasaba cert.private_key como argumento y registraba un evento de auditoría key_view. El JavaTruststoreExportPlugin incluido ignoraba la clave, por lo que la exposición inmediata se limitaba a material de certificado público y entradas de auditoría engañosas, pero un plugin futuro podría haber consumido la clave suministrada. La solución no pasa ninguna clave privada a los plugins que no la requieren y confina las verificaciones de propiedad y el registro de key_view a las exportaciones reales de claves privadas. Este problema está solucionado en la versión 1.9.3. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 19, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-71322', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-19T18:03:59.629156Z'} -
New CVE Received by [email protected]
Aug. 18, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Netflix', 'product': 'lemur', 'versions': [{'status': 'affected', 'version': '< 1.9.3'}]}] Added Description Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false bypassed that check, and the handler still passed cert.private_key as an argument and recorded a key_view audit event. The bundled JavaTruststoreExportPlugin ignored the key, so the immediate exposure was limited to public certificate material and misleading audit entries, but a future plugin could have consumed the supplied key. The fix passes no private key to plugins that do not require one and confines ownership checks and key_view logging to actual private-key exports. This issue is fixed in version 1.9.3. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Added CWE CWE-862 Added Reference https://github.com/Netflix/lemur/commit/5683bbea8b10cce07f9a8abf1e4a7d3b2031c585 Added Reference https://github.com/Netflix/lemur/releases/tag/v1.9.3 Added Reference https://github.com/Netflix/lemur/security/advisories/GHSA-4h97-p9wq-chqj