Netflix Lemur EUVD-2026-61156

Exploitation requires three concurrent conditions: (1) the Lemur deployment must have ADMIN_ONLY_AUTHORITY_CREATION set to false - this is not the default configuration, making the population of vulnerable deployments a subset of all Lemur installations; (2) the attacker must hold a valid Lemur account that is not restricted to read-only access (PR:L per CVSS - any non-read-only authenticated user suffices, including self-service users); and (3) the targeted deployment must be running Lemur prior to version 1.9.3. What limits exploitation: deployments using the default ADMIN_ONLY_AUTHORITY_CREATION=true are fully protected by the existing admin-only gate; read-only Lemur accounts cannot trigger the vulnerable code path; and the resulting sub-CA, while able to issue trusted certificates, is visible in Lemur's audit trail, providing a forensic signal for defenders monitoring authority creation events.

The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N, score 6.5) assigns a local attack vector, which conflicts with the vulnerability's mechanism - exploitation is a direct authenticated HTTP POST to a REST API endpoint, a network-accessible surface. The scope change (S:C) is accurate and meaningful: a successfully created sub-CA can issue certificates trusted by systems that trust the parent root, extending impact beyond Lemur itself. Real-world risk is conditional on ADMIN_ONLY_AUTHORITY_CREATION being disabled (self-service mode), which is not the default; deployments running the default configuration are not exposed. Within affected deployments, exploitation requires only a valid Lemur account with non-read-only privileges - a low bar in organizations using self-service certificate issuance. EPSS data was not provided. No CISA KEV listing exists, and no public exploit code has been identified, suggesting this has not seen opportunistic exploitation. The primary real-world risk is insider threat or compromised non-admin accounts in PKI-sensitive environments.

An attacker with a valid non-admin Lemur account in a deployment running ADMIN_ONLY_AUTHORITY_CREATION=false sends a crafted POST /api/1/authorities request specifying type=subca and a parent authority ID corresponding to an internal root CA for which they hold no role. Lemur resolves the parent authority, invokes cryptography-issuer without checking permissions, and signs the new intermediate using the root's private key. The attacker then uses the newly issued sub-CA to sign arbitrary end-entity certificates trusted by the organization's PKI, or exports the sub-CA private key for use in attacks entirely outside Lemur's visibility.