EUVD-2026-61158
GHSA-4h97-p9wq-chqj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible API requires only a valid authenticated session (PR:L); confidentiality is Low because bundled plugins expose only public certificate material, not private keys.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3Blast Radius
ecosystem impact- 3 pypi packages depend on lemur (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.9.3.
DescriptionCVE.org
Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false bypassed that check, and the handler still passed cert.private_key as an argument and recorded a key_view audit event. The bundled JavaTruststoreExportPlugin ignored the key, so the immediate exposure was limited to public certificate material and misleading audit entries, but a future plugin could have consumed the supplied key. The fix passes no private key to plugins that do not require one and confines ownership checks and key_view logging to actual private-key exports. This issue is fixed in version 1.9.3.
AnalysisAI
Authorization bypass in Netflix Lemur's certificate export API allows any authenticated user to export certificates they do not own by selecting an export plugin that declares requires_key = False. Prior to version 1.9.3, the CertificatePermission ownership check in POST /api/1/certificates/<id>/export was incorrectly nested inside the plugin.requires_key conditional branch, meaning non-key-requiring plugins skipped the authorization gate entirely - while the handler still passed cert.private_key as an argument and recorded a key_view audit event. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target Lemur instance must be running a version prior to 1.9.3. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 Medium score accurately reflects the bounded immediate impact: exploitation requires a valid authenticated session (PR:L), and with the bundled plugin set, an attacker gains only public certificate material (body and chain) belonging to a certificate they do not own, plus the ability to generate false `key_view` audit entries. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Netflix Lemur to version 1.9.3 or later, available at https://github.com/Netflix/lemur/releases/tag/v1.9.3; this release restructures the `CertificateExport.post()` authorization logic so that `CertificatePermission` ownership checks execute unconditionally for all export requests, private key material is passed to plugins only when `requires_key = True`, and `key_view` audit events are recorded only for actual private-key export operations. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today