CVE-2026-71322: Missing Authorization Check in Netflix Lemur Certificate Export
Vulnerability ID: CVE-2026-71322
CVSS Score: 4.3
Published: 2026-08-18
Netflix Lemur, a TLS/SSL certificate management framework, contains a missing authorization check in its certificate export endpoint. Prior to version 1.9.3, the validation logic verifying whether a user had permission to export a certificate was incorrectly placed inside a block that executed only if the selected plugin required a private key. When an authenticated user attempted to export a certificate using a plugin that did not require the private key, the authorization check was bypassed, allowing unauthorized access to the public portions of the certificate and producing misleading audit logs.
TL;DR
A structural nesting error in Netflix Lemur allows authenticated users to bypass ownership authorization checks and export public certificates by selecting export plugins that do not require private keys.
Technical Details
- CWE ID: CWE-862 (Missing Authorization)
- Attack Vector: Network
- CVSS v3.1: 4.3 (Medium)
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Exploit Status: none
- CISA KEV Status: Not Listed
Affected Systems
- Netflix Lemur
-
Lemur: < 1.9.3 (Fixed in:
1.9.3)
Code Analysis
Commit: 5683bbe
Fix CertificatePermission authorization check bypass in CertificateExport
@@ -1574,6 +1569,7 @@ def post(self, certificate_id, data=None):\n \n plugin = data["plugin"]["plugin_object"]\n \n+ private_key = None\n if plugin.requires_key:\n if not cert.private_key:\n return (\n@@ -1585,27 +1581,28 @@ def post(self, certificate_id, data=None):\n 400,\n )\n \n- else:\n- # allow creators\n- if g.current_user != cert.user:\n- owner_role = role_service.get_by_name(cert.owner)\n- permission = CertificatePermission(\n- owner_role, [x.name for x in cert.roles]\n+ # allow creators\n+ if g.current_user != cert.user:\n+ owner_role = role_service.get_by_name(cert.owner)\n+ permission = CertificatePermission(\n+ owner_role, [x.name for x in cert.roles]\n+ )\n+\n+ if not permission.can():\n+ return (\n+ dict(\n+ message="You are not authorized to export this certificate."\n+ ),\n+ 403,\n )\n \n- if not permission.can():\n- return (\n- dict(\n- message="You are not authorized to export this certificate."\n- ),\n- 403,\n- )\n+ log_service.create(g.current_user, "key_view", certificate=cert)\n+ private_key = cert.private_key\n \n options = data["plugin"]["plugin_options"]\n \n- log_service.create(g.current_user, "key_view", certificate=cert)\n extension, passphrase, data = plugin.export(\n- cert.body, cert.chain, cert.private_key, options\n+ cert.body, cert.chain, private_key, options\n )
Mitigation Strategies
- Upgrade Netflix Lemur to version 1.9.3 or higher.
- Implement restrictive API access controls via Web Application Firewalls (WAF) to limit
/api/1/certificates/*/exportendpoints to authorized personnel. - Review custom plugins to ensure they do not expose private key parameters if configured as not requiring keys.
Remediation Steps:
- Download Lemur version 1.9.3 from the official repository release page.
- Apply the database and application migrations corresponding to the release.
- Restart the Lemur application service daemon.
- Examine application logs for historical unauthorized key_view entries.
References
Read the full report for CVE-2026-71322 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)