CVE-2026-71308: Lemur Privilege Escalation Vulnerability

CVE-2026-71308 Overview

Lemur, Netflix's TLS certificate management platform, contains a broken access control vulnerability [CWE-639] in certificate create, upload, and edit request handling. Versions from 0.5.0 through 1.9.2 accept replaces[] or replacements identifiers that AssociatedCertificateSchema resolves through fetch_objects without a CertificatePermission check. An authenticated non-read-only user can reference certificates they do not own, suppressing lifecycle automation and enabling unauthorized substitution.

Critical Impact
An authenticated attacker can suppress notifications on victim certificates, exclude them from get_all_pending_reissue, and cause certificate_rotate to deploy an attacker-controlled certificate to endpoints serving the victim, resulting in fleet-wide TLS disruption.

Affected Products

Netflix Lemur versions 0.5.0 through 1.9.2
Deployments exposing certificate create, upload, or edit APIs to authenticated users
Environments relying on Lemur certificate_rotate automation for endpoint provisioning

Discovery Timeline

2026-08-18 - CVE-2026-71308 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-71308

Vulnerability Analysis

The flaw resides in how Lemur processes the replaces[] and replacements fields on certificate write operations. The AssociatedCertificateSchema deserializer calls fetch_objects to resolve the referenced certificate identifiers into ORM objects. This resolution occurs without invoking CertificatePermission, so a caller can reference any certificate ID regardless of ownership or role.

Once assigned to Certificate.replaces, a SQLAlchemy append listener fires against the referenced victim certificate. That listener disables notifications on the victim and marks it as replaced. The victim is subsequently excluded from get_all_pending_reissue, breaking reissue automation. The certificate_rotate task then treats the attacker certificate as the successor and can deploy it to endpoints previously serving the victim.

Root Cause

The root cause is missing authorization on referenced objects during deserialization. Lemur enforced permissions on the primary certificate being created or edited but trusted the caller's supplied replacement IDs. This is a classic Insecure Direct Object Reference pattern where a foreign key input is dereferenced without checking the caller's rights over the referenced record.

Attack Vector

An authenticated non-read-only user issues a certificate create, upload, or edit request. The request body includes a replaces array populated with certificate IDs owned by another team. Lemur resolves those IDs, mutates the victim state, and rewires downstream rotation logic to the attacker's certificate.

python

# Security patch in lemur/certificates/views.py
        data["creator"] = g.user
        # allowed_issuance_for_domain / authorize_certificate_replacement throw UnauthorizedError if caller is not authorized
        try:
            # unless admin or global_cert_issuer, perform fine grained authorization
            if not g.user.is_admin_or_global_cert_issuer and not data["authority"].is_private_authority:
                service.allowed_issuance_for_domain(data["common_name"], data["extensions"])
            if data.get("replaces"):
                service.authorize_certificate_replacement(data["replaces"], g.current_user)
        except UnauthorizedError as e:
            return dict(message=str(e)), 403

Source: Netflix/lemur commit 2868745

Detection Methods for CVE-2026-71308

Indicators of Compromise

Certificate write API requests where replaces[] references certificates owned by a different team or role than the requester
Unexpected transitions of certificates to a replaced state without a corresponding legitimate reissue workflow
Notification suppression events on certificates that were not manually retired by their owners
certificate_rotate deployments where the successor certificate belongs to a different owner than the predecessor

Detection Strategies

Audit Lemur application logs for POST and PUT requests to /api/1/certificates containing a non-empty replaces array, correlated with the requester identity versus certificate ownership
Diff historical Certificate.notify and Certificate.replaced field states to surface flips that lack an owner-initiated request
Query the database for certificates excluded from get_all_pending_reissue and compare against expected reissue candidates

Monitoring Recommendations

Enable verbose audit logging on certificate mutation endpoints and forward events to a central log store
Alert on any use of the replaces field by non-admin users until upgrade is complete
Track certificate_rotate job output for owner mismatches between the outgoing and incoming certificate

How to Mitigate CVE-2026-71308

Immediate Actions Required

Upgrade Lemur to version 1.9.3, which enforces authorization on every referenced replacement certificate before mutation
Review recent certificate create, upload, and edit events for unauthorized use of replaces[] or replacements
Restore notifications on any certificates incorrectly marked as replaced by unauthorized callers

Patch Information

The fix landed in Lemur 1.9.3. Commit 2868745 in lemur/certificates/service.py and lemur/certificates/views.py introduces authorize_certificate_replacement, which invokes CertificatePermission for each certificate referenced through replaces or replacements before any state mutation occurs. See the GitHub Security Advisory GHSA-cfh6-pv5c-38jv and the Lemur v1.9.3 release notes.

Workarounds

Restrict certificate write API access to trusted operators until the 1.9.3 upgrade is deployed
Apply the upstream patch out of band by backporting the authorize_certificate_replacement call in views.py
Temporarily disable the certificate_rotate automation to prevent unauthorized substitution while remediation is in progress

bash

# Upgrade Lemur to the patched release
pip install --upgrade 'lemur==1.9.3'

# Verify installed version
python -c "import lemur; print(lemur.__version__)"