EUVD-2026-61161
GHSA-pxmc-2ffp-8j67
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Attack is via HTTP API (AV:N); low-privilege account required (PR:L); scope changes to CA backend (S:C); availability impact is high (fleet revocation), integrity low (phantom row creation).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4Blast Radius
ecosystem impact- 3 pypi packages depend on lemur (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.9.3.
DescriptionCVE.org
Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authority_id, serial, or external_id without requiring permission on the underlying authority. PUT /api/1/certificates//revoke authorized the caller against only the selected Lemur row, so the creator of the duplicate bypassed CertificatePermission. The duplicate had no cert.endpoints, which also bypassed the safeguard that prevents revocation of deployed certificates. Issuer plugins then revoked the real CA-side certificate using certificate.body or external_id under the stored authority credentials. An attacker could therefore revoke arbitrary managed certificates and cause fleet-wide TLS denial of service. The fix rejects duplicate authority_id and serial identities, requires authority access on upload, and checks every matching row during revocation. This issue is fixed in version 1.9.3.
AnalysisAI
Privilege escalation and authorization bypass in Netflix Lemur before 1.9.3 permits any authenticated non-read-only user to revoke arbitrary TLS certificates fleet-wide, causing denial of service across all managed endpoints. Two chained API flaws - an unchecked upload endpoint and a row-scoped revocation check - allow an attacker to manufacture a shadow Lemur database record aliasing any real CA-side certificate, then trigger the issuer plugin to revoke the genuine certificate using stored authority credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold a valid Lemur account with at minimum non-read-only privileges (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H, score 7.3) uses AV:L (local), which conflicts directly with the attack mechanism: exploitation requires only HTTP API calls to POST and PUT endpoints - network-accessible in any standard Lemur deployment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Netflix Lemur to version 1.9.3, which is the vendor-confirmed fix version per the release at https://github.com/Netflix/lemur/releases/tag/v1.9.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately restrict certificate revocation permissions to administrative users only and identify all Lemur instances running pre-1.9.3 versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today