---
id: CVE-2026-71322
title: Lemur manages TLS certificate creation
summary: >-
  Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport
  placed its CertificatePermission ownership check inside the
  plugin.requires_key branch for POST /api/1/certificates//export. A plugin
  declaring requires_key false …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-862
vendor: lemur
product: lemur
affected:
  - lemur < 1.9.3
patched:
  - lemur 1.9.3
published: '2026-08-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:02:26.047'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71322'
references:
  - url: >-
      https://github.com/Netflix/lemur/commit/5683bbea8b10cce07f9a8abf1e4a7d3b2031c585
    label: security-advisories@github.com
  - url: 'https://github.com/Netflix/lemur/releases/tag/v1.9.3'
    label: security-advisories@github.com
  - url: 'https://github.com/Netflix/lemur/security/advisories/GHSA-4h97-p9wq-chqj'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-4h97-p9wq-chqj'
tags:
  - nvd
  - ghsa
  - pip
epss: 0.00234
epssPercentile: 0.12739
aliases:
  - GHSA-4h97-p9wq-chqj
ecosystem: pip
ingestedAt: '2026-08-18T21:22:59.616Z'
---

## Overview

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false bypassed that check, and the handler still passed cert.private_key as an argument and recorded a key_view audit event. The bundled JavaTruststoreExportPlugin ignored the key, so the immediate exposure was limited to public certificate material and misleading audit entries, but a future plugin could have consumed the supplied key. The fix passes no private key to plugins that do not require one and confines ownership checks and key_view logging to actual private-key exports. This issue is fixed in version 1.9.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-71322)

Affected packages:

- `lemur < 1.9.3`

Patched in:

- `lemur 1.9.3`

Source: https://github.com/advisories/GHSA-4h97-p9wq-chqj