CVE-2026-71322: Lemur Auth Bypass Vulnerability

CVE-2026-71322 Overview

CVE-2026-71322 is a missing authorization vulnerability [CWE-862] in Netflix Lemur, an open-source tool that manages TLS certificate creation. Versions prior to 1.9.3 place the CertificatePermission ownership check inside the plugin.requires_key branch of the CertificateExport handler for POST /api/1/certificates/<id>/export. A plugin declaring requires_key = false bypasses that check while the handler still passes cert.private_key and records a key_view audit event. The bundled JavaTruststoreExportPlugin ignores the key, limiting immediate exposure to public certificate material and misleading audit entries.

Critical Impact
Authenticated users can invoke certificate export plugins outside their permission scope, receiving misleading key_view audit entries and enabling future plugins to consume private keys they should not access.

Affected Products

Netflix Lemur versions prior to 1.9.3
Deployments using the CertificateExport API endpoint
Environments running custom export plugins that may consume private_key

Discovery Timeline

2026-08-18 - CVE-2026-71322 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-71322

Vulnerability Analysis

The flaw lives in Lemur's certificate export view handler at lemur/certificates/views.py. The CertificateExport resource evaluates plugin.requires_key before deciding whether to enforce a CertificatePermission ownership check. When a plugin declares requires_key = false, the code path skips the authorization gate entirely, yet the handler still forwards cert.private_key into the plugin invocation and writes a key_view audit entry.

The bundled JavaTruststoreExportPlugin discards the supplied key, so the practical impact in default deployments is confined to unauthorized export of public certificate material and inaccurate audit trails suggesting private key access. A third-party or future export plugin declaring requires_key = false while still consuming the argument would expand the impact to private key disclosure.

Root Cause

Authorization logic is nested inside a conditional intended for key-requiring plugins. This structure conflates two distinct decisions: whether the plugin needs the key, and whether the caller is authorized to trigger export. The check should have been unconditional for the export operation, with key material and key_view logging gated separately on requires_key.

Attack Vector

An authenticated Lemur user with low privileges issues a POST request to /api/1/certificates/<id>/export selecting a plugin whose requires_key attribute is false. The handler skips the CertificatePermission check, invokes the plugin with the certificate object including its private_key, and records a misleading key_view audit event attributing key access to the caller.

python

 from flask import Blueprint, make_response, jsonify, g, current_app
 from flask_restful import reqparse, Api, inputs
-
-from lemur.certificates.service import validate_no_duplicate_destinations
-from lemur.common import validators
-from lemur.plugins.bases.authorization import UnauthorizedError
 from sentry_sdk import capture_exception

-from lemur.common.schema import validate_schema
-from lemur.common.utils import paginated_parser
-
-from lemur.auth.service import AuthenticatedResource
 from lemur.auth.permissions import AuthorityPermission, CertificatePermission, StrictRolePermission
-
+from lemur.auth.service import AuthenticatedResource
 from lemur.certificates import service
 from lemur.certificates.models import Certificate
 from lemur.certificates.schemas import (

Source: GitHub Commit for Lemur. The patch restructures the export handler so plugins that do not require a key never receive cert.private_key, and the ownership check plus key_view logging apply only to actual private-key exports.

Detection Methods for CVE-2026-71322

Indicators of Compromise

key_view audit events attributed to users who lack CertificatePermission on the referenced certificate.
POST /api/1/certificates/<id>/export calls targeting plugins with requires_key = false from low-privilege accounts.
Successful export responses returned to callers who have never been granted ownership or role membership for the certificate.

Detection Strategies

Correlate Lemur application logs against the certificate ownership model to flag key_view entries that lack a matching permission grant.
Alert on export API calls where the requesting user role does not intersect the certificate's owning role set.
Baseline plugin usage per user and flag first-time invocations of export plugins declaring requires_key = false.

Monitoring Recommendations

Ship Lemur audit logs to a centralized SIEM and retain key_view records for post-incident review.
Monitor the /api/1/certificates/*/export endpoint for unusual volume, non-owner callers, or unexpected plugin identifiers.
Track deployments of custom export plugins and review their requires_key declaration alongside their handling of cert.private_key.

How to Mitigate CVE-2026-71322

Immediate Actions Required

Upgrade Netflix Lemur to version 1.9.3 or later, which enforces ownership checks and key material scoping in CertificateExport.
Review historical key_view audit entries to identify calls made by users without CertificatePermission on the target certificate.
Inventory installed export plugins and confirm none declare requires_key = false while still consuming the private_key argument.

Patch Information

The fix is available in Lemur 1.9.3. See the GitHub Release v1.9.3, the GitHub Security Advisory GHSA-4h97-p9wq-chqj, and the corresponding GitHub Commit for Lemur. The patch passes no private key to plugins that do not require one and confines ownership checks and key_view logging to actual private-key exports.

Workarounds

Restrict access to the /api/1/certificates/*/export endpoint at a reverse proxy or API gateway until the upgrade completes.
Remove or disable export plugins that declare requires_key = false and cannot be audited for safe handling of the key argument.
Tighten Lemur role assignments so only certificate owners hold roles able to invoke export operations.

bash

# Upgrade Lemur to the patched release
pip install --upgrade 'lemur==1.9.3'

# Verify installed version
python -c "import lemur; print(lemur.__version__)"