Netflix Lemur vulnerabilities

• netflix lemur Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it CVE-2026-71417 Fix available 7.3 HighAugust 18, 2026
• netflix lemur Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False CVE-2026-71322 Fix available 4.3 MediumAugust 18, 2026
• netflix lemur Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority CVE-2026-71317 Fix available 6.5 MediumAugust 18, 2026
• netflix lemur Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs CVE-2026-70666 Fix available 7.4 HighAugust 18, 2026
• netflix lemur Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist CVE-2026-71303 Fix available 7.7 HighAugust 18, 2026
• netflix lemur Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API CVE-2026-71307 Fix available 7.7 HighAugust 18, 2026
• netflix lemur Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates CVE-2026-71308 Fix available 8.1 HighAugust 18, 2026
• netflix lemur Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162) CVE-2026-70667 Fix available 6.3 MediumAugust 18, 2026
• netflix lemur Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR CVE-2026-55166 Fix available 9.9 CriticalJune 25, 2026
• netflix lemur Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure CVE-2026-55165 Fix available 4.8 MediumJune 25, 2026
• netflix lemur Lemur: Plaintext password storage in Lemur user-update path CVE-2026-55164 Fix available 4.9 MediumJune 25, 2026
• netflix lemur Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership CVE-2026-55163 Fix available 6.3 MediumJune 25, 2026
• netflix lemur Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates CVE-2026-55162 Fix available 6.3 MediumJune 25, 2026
• netflix lemur Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission CVE-2026-48508 Fix available 8.8 HighJune 25, 2026
• netflix lemur Lemur: LDAP Filter Injection enables post-authentication privilege escalation CVE-2026-44304 Fix available 8.1 HighMay 6, 2026
• netflix lemur Lemur: LDAP TLS certificate verification globally disabled enables credential interception CVE-2026-44305 Fix available 6.8 MediumMay 6, 2026
• netflix lemur Insecure Random Generation in Netflix Lemur CVE-2023-30797 Fix available 7.5 HighMarch 1, 2023
• netflix lemur Lemur uses static IV per key CVE-2015-7764 Fix available 7.5 HighAugust 9, 2017