CVE-2026-71317
Received Received - Intake

Unauthorized Sub-CA Creation in Lemur Prior to 1.9.3

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMIN_ONLY_AUTHORITY_CREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority creation to cryptography-issuer, which used the parent authority_certificate.private_key to sign a new intermediate. Any authenticated non-read-only user in that supported configuration could chain a sub-CA to an internal root for which the user held no role. The resulting intermediate could issue trusted certificates and its private key could be used outside Lemur, bypassing normal issuance controls. The fix checks AuthorityPermission on every supplied parent before invoking the issuer. This issue is fixed in version 1.9.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-19
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-71317
EUVD
EUVD-2026-61156

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
lemur lemur 1.9.3
netflix lemur to 1.9.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Lemur before 1.9.3 allowed non-admin users to create subordinate CAs by exploiting a missing permission check. When ADMIN_ONLY_AUTHORITY_CREATION was disabled, any authenticated user could chain a sub-CA to an internal root without proper AuthorityPermission. This bypassed normal issuance controls and allowed the creation of trusted certificates.

Detection Guidance

The vulnerability in Lemur prior to 1.9.3 allows unauthorized sub-CA certificate creation. To detect it, check Lemur logs for POST /api/1/authorities requests with type=subca and verify if AuthorityPermission checks were bypassed. Inspect certificate chains for unexpected intermediates linked to internal roots. No specific commands are provided in the context.

Impact Analysis

An attacker could issue trusted certificates under your organization's name, enabling man-in-the-middle attacks or impersonation. The private key of the rogue sub-CA could be used outside Lemur, allowing certificate issuance without oversight. This undermines trust in your PKI infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized certificate issuance, violating trust and audit requirements in GDPR (data integrity) and HIPAA (secure communications). It may result in non-compliance due to lack of proper access controls and oversight in certificate management.

Mitigation Strategies

Upgrade Lemur to version 1.9.3 or later to apply the fix. Ensure ADMIN_ONLY_AUTHORITY_CREATION is enabled if sub-CA creation must be restricted. Review and revoke any unauthorized certificates or private keys generated due to this issue. Monitor for unusual certificate issuance patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71317. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart