EUVD-2026-61152
GHSA-cfh6-pv5c-38jv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network API requires only low-privilege authentication; no confidentiality impact, but both integrity and availability are high due to unauthorized cert substitution and notification suppression.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as replaced. The victim was then excluded from get_all_pending_reissue, and certificate_rotate could deploy the attacker certificate to endpoints serving the victim. An authenticated non-read-only user could target certificates for which the user had no ownership or role, suppress lifecycle automation, and cause fleet-wide TLS disruption or unauthorized substitution. The fix authorizes every referenced replacement certificate before mutation. This issue is fixed in version 1.9.3.
AnalysisAI
Broken object-level authorization in Netflix Lemur versions 0.5.0 through 1.9.3 permits any authenticated non-read-only user to silently hijack TLS certificate lifecycle management for certificates they do not own. By supplying arbitrary certificate identifiers in the replaces[] or replacements field of create, upload, or edit requests, an attacker triggers an append listener that suppresses the victim certificate's expiry notifications, marks it as replaced, and excludes it from get_all_pending_reissue - after which certificate_rotate may deploy the attacker's certificate to production endpoints previously serving the victim. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, authenticated Lemur session with at minimum non-read-only privileges - read-only accounts cannot invoke the certificate create, upload, or edit endpoints. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) accurately reflects the real-world risk profile: the attack is low-complexity, requires only a standard authenticated session, and produces high integrity and availability impact on the managed certificate fleet without any privileged escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is upgrading to Netflix Lemur version 1.9.3, which is confirmed available at https://github.com/Netflix/lemur/releases/tag/v1.9.3 and resolves the issue by enforcing CertificatePermission checks on every replacement certificate reference before any mutation is committed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Netflix Lemur deployments across the organization and confirm version numbers; escalate to critical priority any systems running versions 0.5.0 through 1.9.2. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today