CVE-2026-55163: Lemur Privilege Escalation Vulnerability

CVE-2026-55163 Overview

CVE-2026-55163 is a broken access control vulnerability [CWE-863] in Netflix Lemur, an open-source tool that manages TLS certificate creation. Versions prior to 1.9.2 authorize PUT /api/1/roles/<id> requests with RoleMemberPermission(role_id), which grants access to any existing member of the target role rather than restricting changes to administrators. A non-admin role member can modify the users and name fields through service.update, enabling lateral privilege grants or denial of access to legitimate members. The DELETE handler already enforced admin_permission, making the PUT authorization inconsistent. The issue is fixed in version 1.9.2.

Critical Impact
Any authenticated member of a Lemur role can add or remove other users and rename the role, altering who controls certificate and certificate authority access.

Affected Products

Netflix Lemur versions prior to 1.9.2
The lemur/roles/views.py PUT handler at line 298
Deployments where non-admin users are assigned to roles that gate certificate or authority access

Discovery Timeline

2026-08-18 - CVE-2026-55163 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-55163

Vulnerability Analysis

Lemur exposes REST endpoints under /api/1/roles/<id> for managing role membership and metadata. Roles in Lemur gate access to certificates and certificate authorities, so role membership is a security-sensitive boundary. The affected put method in lemur/roles/views.py was decorated only with a member-level permission check.

Because RoleMemberPermission(role_id) returns true for any user already in the role, any member could invoke the update handler. The handler forwards data["users"] and data["name"] to service.update, allowing the caller to overwrite the membership list and rename the role. An attacker inside a role can therefore grant role membership to accomplices, remove administrators or peers, or rename the role to disrupt operations.

The corresponding DELETE handler already required admin_permission, confirming that administrator-only authorization was the intended design for state changes to role identity and composition.

Root Cause

The root cause is inconsistent authorization enforcement between HTTP methods on the same resource. The PUT handler relied on RoleMemberPermission, which conflates membership with administrative authority over the role. The fix applies @admin_permission.require(http_exception=403) to the put method so that only administrators can modify role membership or metadata.

Attack Vector

An attacker needs valid Lemur credentials and existing membership in a target role. The attacker sends a crafted PUT request to /api/1/roles/<id> with a modified users array to add a controlled account or remove legitimate members, or with a new name to rename the role. No user interaction is required and the attack is delivered over the network.

python

             403,
         )
 
+    @admin_permission.require(http_exception=403)
     @validate_schema(role_input_schema, role_output_schema)
     def put(self, role_id, data=None):
         """

Source: GitHub Commit 9523a3b. The patch adds the admin_permission decorator to the put handler so it matches the existing DELETE authorization.

Detection Methods for CVE-2026-55163

Indicators of Compromise

Unexpected PUT /api/1/roles/<id> requests from user accounts that are role members but not administrators.
Audit log entries showing changes to a role's users list or name field without a corresponding administrator session.
New accounts appearing in security-sensitive roles that gate certificate or certificate authority access.
Legitimate administrators or reviewers removed from roles without an approved change ticket.

Detection Strategies

Review Lemur application logs and reverse proxy access logs for PUT requests to /api/1/roles/ and correlate with the authenticated user's admin status.
Diff role membership snapshots on a schedule and alert on membership changes outside change-management windows.
Compare PUT and DELETE activity on the roles endpoint to identify accounts modifying roles they do not administer.

Monitoring Recommendations

Forward Lemur audit logs and web server logs to a centralized log platform for retention and query.
Alert on any modification of roles tied to production certificate authorities.
Baseline normal administrator activity and flag role-mutation calls originating from non-admin sessions.

How to Mitigate CVE-2026-55163

Immediate Actions Required

Upgrade Netflix Lemur to version 1.9.2 or later, which enforces admin_permission on the PUT roles handler.
Audit current membership of every role that grants access to certificates or certificate authorities and remove unauthorized accounts.
Rotate credentials for any account that was improperly added through a vulnerable PUT call.

Patch Information

The fix is available in Netflix Lemur v1.9.2. The change is described in GHSA-x3vf-mgxj-7785 and applied in commit 9523a3b. The patch adds @admin_permission.require(http_exception=403) to the put method in lemur/roles/views.py, aligning it with the existing DELETE handler.

Workarounds

Restrict network access to the Lemur API so only trusted administrators can reach /api/1/roles/ endpoints until the upgrade is deployed.
Reduce role membership to the minimum required set, limiting the pool of accounts that can exploit the weak PUT authorization.
Place a reverse proxy rule in front of Lemur that blocks PUT requests to /api/1/roles/<id> from non-administrator sessions.

bash

# Upgrade Lemur to the fixed release
pip install --upgrade 'lemur==1.9.2'

# Optional: NGINX rule to block PUT on the roles endpoint pending upgrade
# location ~ ^/api/1/roles/[0-9]+$ {
#     limit_except GET POST DELETE { deny all; }
#     proxy_pass http://lemur_backend;
# }