What’s Vulnerable › Products
Netflix lemur vulnerabilities
18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your Netflix lemur version is affected
Latest Netflix lemur vulnerabilities
- CVE-2026-71417 — Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it (CVSS 7.3)
- CVE-2026-71322 — Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False (CVSS 4.3)
- CVE-2026-71317 — Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority (CVSS 6.5)
- CVE-2026-71308 — Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates (CVSS 8.1)
- CVE-2026-71307 — Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API (CVSS 7.7)
- CVE-2026-71303 — Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist (CVSS 7.7)
- CVE-2026-70666 — Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs (CVSS 7.4)
- CVE-2026-70667 — Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162) (CVSS 6.3)
- CVE-2026-55166 — Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR (CVSS 9.9)
- CVE-2026-55165 — Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure (CVSS 4.8)
- CVE-2026-55164 — Lemur: Plaintext password storage in Lemur user-update path (CVSS 4.9)
- CVE-2026-55163 — Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership (CVSS 6.3)
- CVE-2026-55162 — Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates (CVSS 6.3)
- CVE-2026-48508 — Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission (CVSS 8.8)
- CVE-2026-44305 — Lemur: LDAP TLS certificate verification globally disabled enables credential interception (CVSS 6.8)
- CVE-2026-44304 — Lemur: LDAP Filter Injection enables post-authentication privilege escalation (CVSS 8.1)
- CVE-2023-30797 — Insecure Random Generation in Netflix Lemur (CVSS 7.5)
- CVE-2015-7764 — (CVSS 7.5)