Netflix vulnerabilities

Products

• Lemur 18
• Dispatch 4
• Chaos Monkey 2
• Consoleme 2

Newest

• netflix lemur Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it CVE-2026-71417 Fix available 7.3 HighAugust 18, 2026
• netflix lemur Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False CVE-2026-71322 Fix available 4.3 MediumAugust 18, 2026
• netflix lemur Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority CVE-2026-71317 Fix available 6.5 MediumAugust 18, 2026
• netflix lemur Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs CVE-2026-70666 Fix available 7.4 HighAugust 18, 2026
• netflix lemur Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist CVE-2026-71303 Fix available 7.7 HighAugust 18, 2026
• netflix lemur Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API CVE-2026-71307 Fix available 7.7 HighAugust 18, 2026
• netflix lemur Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates CVE-2026-71308 Fix available 8.1 HighAugust 18, 2026
• netflix lemur Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162) CVE-2026-70667 Fix available 6.3 MediumAugust 18, 2026
• netflix lemur Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR CVE-2026-55166 Fix available 9.9 CriticalJune 25, 2026
• netflix lemur Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure CVE-2026-55165 Fix available 4.8 MediumJune 25, 2026
• netflix lemur Lemur: Plaintext password storage in Lemur user-update path CVE-2026-55164 Fix available 4.9 MediumJune 25, 2026
• netflix lemur Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership CVE-2026-55163 Fix available 6.3 MediumJune 25, 2026
• netflix lemur Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates CVE-2026-55162 Fix available 6.3 MediumJune 25, 2026
• netflix lemur Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission CVE-2026-48508 Fix available 8.8 HighJune 25, 2026
• netflix lemur Lemur: LDAP Filter Injection enables post-authentication privilege escalation CVE-2026-44304 Fix available 8.1 HighMay 6, 2026
• netflix lemur Lemur: LDAP TLS certificate verification globally disabled enables credential interception CVE-2026-44305 Fix available 6.8 MediumMay 6, 2026
• netflix e2nest A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a CVE-2024-9301 8.7 HighSeptember 27, 2024
• netflix dispatch Server-Side Template Injection in Dispatch Message Templates CVE-2024-7093 9.4 CriticalAugust 1, 2024
• netflix consoleme Arbitrary File Read Vulnerability in ConsoleMe via Limited Git command RCE CVE-2024-5023 Fix available 9.3 CriticalMay 16, 2024
• netflix genie Path Traversal vulnerability via File Uploads in Genie CVE-2024-4701 Public exploitFix available EPSS 24.6% 9.9 CriticalMay 9, 2024
• netflix dispatch Dispatch writes JWT tokens in error message CVE-2023-40171 9.1 CriticalAugust 17, 2023
• netflix lemur Insecure Random Generation in Netflix Lemur CVE-2023-30797 Fix available 7.5 HighMarch 1, 2023
• netflix consoleme Use of Externally-Controlled Format String in consoleme CVE-2022-27177 Fix available 9.8 CriticalApril 1, 2022
• netflix hollow Insecure temporary file in Netflix OSS Hollow CVE-2021-28099 4.4 MediumMarch 23, 2021
• netflix priam Netflix/Priam: Temporary Directory Information Disclosure CVE-2021-28100 5.5 MediumMarch 23, 2021
• jenkins project chaos monkey plugin, netflix chaos monkey +1 more Missing permission checks in Jenkins Chaos Monkey Plugin CVE-2020-2323 Fix available 5.3 MediumDecember 3, 2020
• jenkins project chaos monkey plugin, netflix chaos monkey +1 more Missing permission checks in Jenkins Chaos Monkey Plugin CVE-2020-2322 Fix available 7.5 HighDecember 3, 2020
• netflix dispatch There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting... CVE-2020-9299 5.4 MediumNovember 9, 2020
• netflix dispatch The Access Control issues include allowing a regular user to view a restricted incident, user... CVE-2020-9300 6.5 MediumNovember 9, 2020
• netflix titus Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380)... CVE-2020-9297 9.8 CriticalJuly 14, 2020
• netflix conductor Expression Language Injection in Netflix Conductor CVE-2020-9296 Fix available 9.8 CriticalJune 16, 2020
• netflix dial reference, dial reference source code repo (https://github.com/netflix/dial-reference) +1 more Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019. CVE-2019-10028 7.5 HighJune 21, 2019
• netflix lemur Lemur uses static IV per key CVE-2015-7764 Fix available 7.5 HighAugust 9, 2017
• netflix security monkey Netflix Security Monkey Open Redirect vulnerability CVE-2017-7266 Fix available 6.1 MediumMarch 26, 2017