What’s Vulnerable › Vulnerabilities

CVE-2026-71322: Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-18 · updated 2026-10-22
• Weakness: CWE-862

Description

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false bypassed that check, and the handler still passed cert.private_key as an argument and recorded a key_view audit event. The bundled JavaTruststoreExportPlugin ignored the key, so the immediate exposure was limited to public certificate material and misleading audit entries, but a future plugin could have consumed the supplied key. The fix passes no private key to plugins that do not require one and confines ownership checks and key_view logging to actual private-key exports. This issue is fixed in version 1.9.3.

Affected products

• Netflix lemur: before 1.9.3

References

• https://github.com/Netflix/lemur/commit/5683bbea8b10cce07f9a8abf1e4a7d3b2031c585
• https://github.com/Netflix/lemur/releases/tag/v1.9.3
• https://github.com/Netflix/lemur/security/advisories/GHSA-4h97-p9wq-chqj

Get alerted when CVE-2026-71322 or the next vulnerability affects your stack