CVE-2026-71317: Lemur TLS Auth Bypass Vulnerability

CVE-2026-71317 Overview

CVE-2026-71317 is a missing authorization vulnerability [CWE-862] in Netflix Lemur, an open source tool that manages TLS certificate creation. Versions prior to 1.9.3 fail to enforce AuthorityPermission on the parent authority when a caller submits POST /api/1/authorities with type=subca and ADMIN_ONLY_AUTHORITY_CREATION is set to False. Any authenticated, non-read-only user can chain a sub-CA to an internal root they hold no role on. The resulting intermediate can issue trusted certificates, and its private key can be exported outside Lemur, bypassing normal issuance controls.

Critical Impact
Authenticated users can create sub-CAs chained to arbitrary internal root authorities, gaining the ability to issue trusted certificates for any identity within the organization's PKI trust boundary.

Affected Products

Netflix Lemur versions prior to 1.9.3
Deployments where ADMIN_ONLY_AUTHORITY_CREATION is set to False
Any Lemur instance exposing POST /api/1/authorities to non-admin authenticated users

Discovery Timeline

2026-08-18 - CVE-2026-71317 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-71317

Vulnerability Analysis

The flaw resides in Lemur's authority creation endpoint. When a client sends POST /api/1/authorities with type=subca, the AssociatedAuthoritySchema resolves the caller-supplied parent field and forwards it into the authority creation pipeline. The pipeline then hands the parent to cryptography-issuer, which uses the parent's authority_certificate.private_key to sign a new intermediate CA. No permission check is performed against the parent authority itself. If the deployment permits general authority creation, any authenticated non-read-only user can pick any internal root and produce a chained intermediate CA under it.

Root Cause

The endpoint validates that the caller can create authorities but never verifies the caller's role on the parent authority being extended. The missing AuthorityPermission check on the parent object is the direct root cause, categorized as [CWE-862] Missing Authorization.

Attack Vector

Exploitation requires an authenticated Lemur account with non-read-only privileges and a target deployment with ADMIN_ONLY_AUTHORITY_CREATION=False. The attacker issues a single API request specifying type=subca and setting parent to a privileged internal root. Lemur signs a new intermediate using that root's private key. The attacker can then issue certificates through Lemur or export the intermediate key material for offline abuse.

python

         if not permission.can() or not StrictRolePermission().can():
             return dict(message="You are not allowed to create a new authority."), 403

+        parent = data.get("parent")
+        if parent:
+            parent_roles = [x.name for x in parent.roles]
+            if not AuthorityPermission(parent.id, parent_roles).can():
+                return dict(message="You are not authorized to use the specified parent authority."), 403
+
         if not validators.is_valid_owner(data["owner"]):
             return dict(message=f"Invalid owner: check if {data['owner']} is a valid group email. Individuals cannot "
                                 f"be authority owners."), 412

Source: GitHub Commit 8669011. The patch adds an explicit AuthorityPermission check against the supplied parent before invoking the issuer.

Detection Methods for CVE-2026-71317

Indicators of Compromise

Unexpected authority records in the Lemur database with type=subca whose creator lacks a role on the referenced parent authority.
New intermediate CAs issued by internal roots without a corresponding change ticket or approval.
Certificates signed by newly created intermediates whose common names or SANs fall outside the creator's normal ownership scope.

Detection Strategies

Query Lemur audit logs for POST /api/1/authorities calls containing type=subca and correlate the requesting user against the parent authority's role assignments.
Alert on any authority creation event where the resulting chain terminates at a root the requestor does not hold a role on.
Review certificate transparency and internal issuance logs for certificates signed by intermediates created after the vulnerable window.

Monitoring Recommendations

Forward Lemur application logs and API access logs to a centralized SIEM for correlation with identity events.
Baseline authority creation frequency and alert on deviations, particularly sub-CA creations off privileged roots.
Monitor for exports or external use of intermediate private keys tied to Lemur-managed authorities.

How to Mitigate CVE-2026-71317

Immediate Actions Required

Upgrade Lemur to version 1.9.3 or later, which enforces AuthorityPermission on the supplied parent before invoking the issuer.
Audit all sub-CAs created while running vulnerable versions and revoke any intermediate created by users lacking parent authority roles.
Rotate or revoke certificates issued by any suspicious intermediate CA and reissue from a trusted authority.

Patch Information

The fix is included in Lemur 1.9.3. See the GitHub Release v1.9.3 and the GitHub Security Advisory GHSA-g7p5-89mh-248h. The patch is applied in commit 8669011 within lemur/authorities/views.py.

Workarounds

Set ADMIN_ONLY_AUTHORITY_CREATION=True in the Lemur configuration until the patch can be deployed, restricting authority creation to administrators.
Restrict network access to the /api/1/authorities endpoint to trusted operators via an upstream proxy or WAF rule.
Reduce non-admin user privileges to read-only where feasible until the upgrade is complete.

bash

# Configuration example - restrict authority creation to admins only
# In lemur.conf.py
ADMIN_ONLY_AUTHORITY_CREATION = True