CVE-2026-48508: Lemur TLS Auth Bypass Vulnerability

CVE-2026-48508 Overview

CVE-2026-48508 is an authorization bypass vulnerability in Netflix Lemur, an open-source tool that manages TLS certificate creation. Versions prior to 1.9.1 initialize StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py with zero Need objects when the ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT flags are unset. Both flags default to False, causing Flask-Principal's Permission.allows() to return True for any authenticated identity. The flaw is tracked as [CWE-863: Incorrect Authorization].

Critical Impact
A read-only authenticated user can create root Certificate Authorities, upload arbitrary certificates, reach an SSRF sink through notifications, and create domain entries.

Affected Products

Netflix Lemur versions prior to 1.9.1
Deployments with ADMIN_ONLY_AUTHORITY_CREATION unset or set to False
Deployments with LEMUR_STRICT_ROLE_ENFORCEMENT unset or set to False

Discovery Timeline

2026-08-18 - CVE-2026-48508 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-48508

Vulnerability Analysis

The flaw resides in Lemur's permission classes StrictRolePermission and AuthorityCreatorPermission inside lemur/auth/permissions.py. Each class calls flask_principal.Permission.__init__() with zero Need objects when the governing feature flags are unset. Flask-Principal treats a Permission with an empty needs set as always satisfied, so Permission.allows() returns True for every authenticated identity. The .can() authorization gate therefore admits users assigned the read-only role.

The consequences map to concrete API surface. A read-only user can issue POST /api/1/authorities to create root Certificate Authorities, POST /api/1/certificates/upload and POST /api/1/pending_certificates/<id>/upload to upload arbitrary certificates, and POST /api/1/domains to register domain entries. The same identity can create or edit notifications via POST /api/1/notifications and PUT/DELETE /api/1/notifications/<id>, which reach a server-side request forgery (SSRF) sink.

Root Cause

Both ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT defaulted to False. The permission constructors interpreted the unset state as "no required needs," collapsing role enforcement to an authenticated check. Explicitly setting either flag to False continues to opt into the permissive behavior after upgrade.

Attack Vector

An attacker requires only valid credentials for any Lemur account, including a read-only account. Authenticated requests to the affected endpoints are accepted without a role check, so the attacker can pivot to certificate issuance, tampering, and SSRF against internal notification targets.

text

# Patch excerpt from CHANGELOG.rst (v1.9.1)
1.9.1 - `2026-05-19`
- Fixed authorization bypass (GHSA-qcqw-jwxc-2hqg) where ``StrictRolePermission`` and ``AuthorityCreatorPermission``
  granted access to any authenticated user on default Lemur installs. Both ``LEMUR_STRICT_ROLE_ENFORCEMENT`` and
  ``ADMIN_ONLY_AUTHORITY_CREATION`` now default to ``True`` (fail-closed). Existing installs that explicitly set
  either flag to ``False`` are unaffected.

Source: GitHub Commit e6a41e2

Detection Methods for CVE-2026-48508

Indicators of Compromise

Successful POST /api/1/authorities requests originating from accounts assigned the read-only role.
Certificate upload activity on POST /api/1/certificates/upload or POST /api/1/pending_certificates/<id>/upload from non-admin identities.
Creation or modification of notification records via POST /api/1/notifications or PUT/DELETE /api/1/notifications/<id> triggering outbound requests to unexpected hosts.
New entries in POST /api/1/domains submitted by low-privilege users.

Detection Strategies

Correlate Lemur application logs with the assigned role of the authenticated principal; alert when write endpoints are invoked by read-only users.
Review the audit trail for newly created Certificate Authorities and cross-reference against change tickets.
Inspect notification targets for private IP ranges, cloud metadata endpoints, or other SSRF-relevant destinations.

Monitoring Recommendations

Enable verbose access logging on the Lemur API and forward events to a centralized analytics platform.
Baseline expected authors of authorities, certificates, and notifications, then alert on deviations.
Monitor egress from the Lemur host for connections to internal-only services following notification changes.

How to Mitigate CVE-2026-48508

Immediate Actions Required

Upgrade Netflix Lemur to version 1.9.1 or later.
Audit user roles and revoke unnecessary accounts, particularly stale read-only identities.
Review recent activity on /api/1/authorities, /api/1/certificates/upload, /api/1/notifications, and /api/1/domains for unauthorized changes.
Revoke or reissue any certificates or CAs created by non-admin identities during the exposure window.

Patch Information

The issue is fixed in Lemur 1.9.1. The patch changes the defaults for both LEMUR_STRICT_ROLE_ENFORCEMENT and ADMIN_ONLY_AUTHORITY_CREATION to True, making role enforcement fail-closed. See the GitHub Security Advisory GHSA-qcqw-jwxc-2hqg and the Lemur v1.9.1 Release Notes.

Workarounds

Explicitly set LEMUR_STRICT_ROLE_ENFORCEMENT = True in the Lemur configuration.
Explicitly set ADMIN_ONLY_AUTHORITY_CREATION = True to restrict CA creation to administrators.
Restrict network access to the Lemur API to trusted administrative networks until the upgrade is complete.

bash

# Lemur configuration example (fail-closed role enforcement)
LEMUR_STRICT_ROLE_ENFORCEMENT = True
ADMIN_ONLY_AUTHORITY_CREATION = True