lemur vulnerabilities
CVEs whose affected-version data names the lemur package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
18 CVEsRSS
CVE-2026-70666High· 7.4Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and direct setup_acme_client_no_retry to an attacker-controlled ACME server. ACME…
CVE-2026-70667Medium· 6.3Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call fo…
CVE-2026-71303High· 7.7Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying …
CVE-2026-71307High· 7.7Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw optio…
CVE-2026-71308High· 8.1Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a Certific…
CVE-2026-71317Medium· 6.5Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMIN_ONLY_AUTHORITY_CREATION was false. AssociatedAuthoritySchema resolved …
CVE-2026-71322Medium· 4.3Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false …
CVE-2026-71417High· 7.3Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authority_id, serial, or external_id without requiring permiss…
CVE-2026-48508High· 8.8Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION…
CVE-2026-55162Medium· 6.3Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequat…
CVE-2026-55163Medium· 6.3Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role.…
CVE-2026-55164Medium· 4.9Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Be…
CVE-2026-55165Medium· 4.8Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_token_header to read header_data["alg"] from an unverified token and passed that attacker-controlled value to decode_wit…
CVE-2026-55166Critical· 9.9Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destination restriction and trigger AcmeHandler.setup_acme_client to make backend req…
CVE-2026-44305Medium· 6.8Lemur: LDAP Authentication Globally Disables TLS Certificate Verification When LDAP_USE_TLS Is Enabled
Lemur: LDAP Authentication Globally Disables TLS Certificate Verification When LDAP_USE_TLS Is Enabled
CVE-2026-44304High· 8.1Lemur: LDAP Filter Injection enables post-authentication privilege escalation
Lemur: LDAP Filter Injection enables post-authentication privilege escalation
CVE-2023-30797High· 7.5Lemur subject to insecure random generation
Lemur subject to insecure random generation
CVE-2015-7764High· 7.5Lemur uses static IV per key
Lemur uses static IV per key