{"id":"CVE-2026-71308","title":"Lemur manages TLS certificate creation","summary":"Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a Certific…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","cwe":["CWE-639","CWE-862"],"vendor":"lemur","product":"lemur","affected":["lemur >= 0.5.0, <= 1.9.2"],"patched":["lemur 1.9.3"],"published":"2026-08-18","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:02:26.047","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71308","references":[{"url":"https://github.com/Netflix/lemur/commit/286874535160952143b0afe2d356642669f9d4c6","label":"security-advisories@github.com"},{"url":"https://github.com/Netflix/lemur/releases/tag/v1.9.3","label":"security-advisories@github.com"},{"url":"https://github.com/Netflix/lemur/security/advisories/GHSA-cfh6-pv5c-38jv","label":"security-advisories@github.com"},{"url":"https://github.com/Netflix/lemur/security/advisories/GHSA-cfh6-pv5c-38jv","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-cfh6-pv5c-38jv"}],"tags":["nvd","ghsa","pip"],"epss":0.00217,"epssPercentile":0.12373,"aliases":["GHSA-cfh6-pv5c-38jv"],"ecosystem":"pip","ingestedAt":"2026-08-18T21:22:59.688Z","slug":"CVE-2026-71308","body":"## Overview\n\nLemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as replaced. The victim was then excluded from get_all_pending_reissue, and certificate_rotate could deploy the attacker certificate to endpoints serving the victim. An authenticated non-read-only user could target certificates for which the user had no ownership or role, suppress lifecycle automation, and cause fleet-wide TLS disruption or unauthorized substitution. The fix authorizes every referenced replacement certificate before mutation. This issue is fixed in version 1.9.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-71308)\n\nAffected packages:\n\n- `lemur >= 0.5.0, <= 1.9.2`\n\nPatched in:\n\n- `lemur 1.9.3`\n\nSource: https://github.com/advisories/GHSA-cfh6-pv5c-38jv","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}