CVE-2026-71308: falha de alta gravidade em Netflix lemur
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.3%
Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as replaced. The victim was then excluded from get_all_pending_reissue, and certificate_rotate could deploy the attacker certificate to endpoints serving the victim. An authenticated non-read-only user could target certificates for which the user had no ownership or role, suppress lifecycle automation, and cause fleet-wide TLS disruption or unauthorized substitution. The fix authorizes every referenced replacement certificate before mutation. This issue is fixed in version 1.9.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
Netflix · lemurCVEs relacionadas — Netflix lemur
No mesmo produto, das mais perigosas para as menos.
CVE-2026-48508HIGHLemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermissionEPSS 0.3%CVE-2026-71307HIGHLemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations APIEPSS 0.3%CVE-2026-55164MEDIUMLemur: Plaintext password storage in Lemur user-update pathEPSS 0.3%CVE-2026-55166CRITICALLemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOREPSS 0.3%CVE-2026-71303HIGHLemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlistEPSS 0.3%CVE-2026-71322MEDIUMLemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = FalseEPSS 0.2%