CVE-2026-71308
Received Received - Intake

Remote Code Execution in Lemur TLS Certificate Manager

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as replaced. The victim was then excluded from get_all_pending_reissue, and certificate_rotate could deploy the attacker certificate to endpoints serving the victim. An authenticated non-read-only user could target certificates for which the user had no ownership or role, suppress lifecycle automation, and cause fleet-wide TLS disruption or unauthorized substitution. The fix authorizes every referenced replacement certificate before mutation. This issue is fixed in version 1.9.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-19
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-71308
EUVD
EUVD-2026-61152

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
lemur lemur to 1.9.3 (inc)
netflix lemur From 0.5.0 (inc) to 1.9.3 (exc)
netflix lemur 1.9.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Lemur (versions 0.5.0 to 1.9.2) allows authenticated non-read-only users to manipulate TLS certificates without proper ownership or role permissions. Attackers can exploit a flaw in certificate replacement logic to suppress lifecycle automation, mark victim certificates as replaced, and deploy unauthorized certificates across endpoints. The issue stems from missing permission checks when resolving replacement identifiers, enabling fleet-wide TLS disruption or unauthorized substitutions.

Detection Guidance

Detecting this vulnerability requires checking Lemur versions prior to 1.9.3 and reviewing certificate replacement configurations. Inspect Lemur logs for unauthorized certificate replacements or suppressed notifications. Check for certificates marked as replaced without valid ownership or role permissions.

Impact Analysis

If exploited, this vulnerability could allow attackers to replace legitimate TLS certificates with malicious ones across your infrastructure. This may lead to man-in-the-middle attacks, data interception, or unauthorized access to systems. Organizations could face service disruptions, data breaches, or compliance violations due to compromised certificate trust chains.

Compliance Impact

This vulnerability could undermine compliance with GDPR (data protection) and HIPAA (health data security) by enabling unauthorized certificate substitutions. Compromised certificates may facilitate data breaches, violating confidentiality requirements. Organizations relying on TLS for secure communications could face regulatory penalties for failing to protect sensitive data.

Mitigation Strategies

Upgrade Lemur to version 1.9.3 or later immediately. Review all certificate replacement requests and revoke unauthorized replacements. Audit user permissions to ensure only authorized users can modify certificates. Monitor for fleet-wide TLS disruptions or unauthorized substitutions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71308. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart