What is the CVSS score of CVE-2026-71317?

CVE-2026-71317 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-71317?

Yes, a public proof-of-concept exploit is available for CVE-2026-71317. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-71317?

Yes, a patch is available for CVE-2026-71317. Update the affected software to the latest version immediately.

Netflix Lemur CVE-2026-71317

EUVD-2026-61156 MEDIUM

Missing Authorization (CWE-862)

2026-08-18 security-advisories@github.com

GHSA-g7p5-89mh-248h

Authentication Bypass

6.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

vuln.today AI

7.7 HIGH

REST API exploitation is network-accessible (AV:N not AV:L); PR:L reflects required non-read-only authentication; S:C captures sub-CA trust propagating beyond Lemur to relying systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 18, 2026 - 20:41 vuln.today

Analysis Generated

Aug 18, 2026 - 20:41 vuln.today

Patch available

Aug 18, 2026 - 20:34 EUVD

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 pypi packages depend on lemur (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.9.3.

DescriptionCVE.org

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMIN_ONLY_AUTHORITY_CREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority creation to cryptography-issuer, which used the parent authority_certificate.private_key to sign a new intermediate. Any authenticated non-read-only user in that supported configuration could chain a sub-CA to an internal root for which the user held no role. The resulting intermediate could issue trusted certificates and its private key could be used outside Lemur, bypassing normal issuance controls. The fix checks AuthorityPermission on every supplied parent before invoking the issuer. This issue is fixed in version 1.9.3.

AnalysisAI

Privilege escalation in Netflix Lemur's certificate authority API allows any authenticated non-read-only user to mint a sub-CA chained to an internal root CA they do not control, when the ADMIN_ONLY_AUTHORITY_CREATION flag is disabled. The POST /api/1/authorities endpoint (type=subca) failed to verify AuthorityPermission on the caller-supplied parent, allowing the caller to invoke cryptography-issuer which signed the new intermediate using the parent root's private key. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Lemur with non-admin account

Delivery

POST /api/1/authorities with type=subca and attacker-chosen parent ID

Exploit

Missing AuthorityPermission check allows parent resolution

Execution

cryptography-issuer signs new intermediate with root CA private key

Persist

Sub-CA issued and private key accessible to attacker

Impact

Issue arbitrary trusted certificates outside Lemur controls

Access

Authenticate to Lemur with non-admin account

Delivery

POST /api/1/authorities with type=subca and attacker-chosen parent ID

Exploit

Missing AuthorityPermission check allows parent resolution

Execution

cryptography-issuer signs new intermediate with root CA private key

Persist

Sub-CA issued and private key accessible to attacker

Impact

Issue arbitrary trusted certificates outside Lemur controls

Vulnerability AssessmentAI

Exploitation	Exploitation requires three concurrent conditions: (1) the Lemur deployment must have ADMIN_ONLY_AUTHORITY_CREATION set to false - this is not the default configuration, making the population of vulnerable deployments a subset of all Lemur installations; (2) the attacker must hold a valid Lemur account that is not restricted to read-only access (PR:L per CVSS - any non-read-only authenticated user suffices, including self-service users); and (3) the targeted deployment must be running Lemur prior to version 1.9.3. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N, score 6.5) assigns a local attack vector, which conflicts with the vulnerability's mechanism - exploitation is a direct authenticated HTTP POST to a REST API endpoint, a network-accessible surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a valid non-admin Lemur account in a deployment running ADMIN_ONLY_AUTHORITY_CREATION=false sends a crafted POST /api/1/authorities request specifying type=subca and a parent authority ID corresponding to an internal root CA for which they hold no role. Lemur resolves the parent authority, invokes cryptography-issuer without checking permissions, and signs the new intermediate using the root's private key. …
Remediation	Upgrade Lemur to version 1.9.3 or later, available at https://github.com/Netflix/lemur/releases/tag/v1.9.3. … Detailed patch versions, workarounds, and compensating controls in full report.