CVE-2026-71417: Authorization Bypass Leading to Unauthorized TLS Certificate Revocation in Netflix Lemur

Vulnerability ID: CVE-2026-71417
CVSS Score: 7.3
Published: 2026-08-18

CVE-2026-71417 is an authorization bypass vulnerability (CWE-639) in Netflix Lemur, an open-source TLS certificate management framework. In versions prior to 1.9.3, a low-privileged authenticated user can bypass role and certificate-level permission boundaries to revoke arbitrary managed TLS certificates at the upstream Certificate Authority (CA). This vulnerability stems from an architectural issue where Lemur evaluates authorization against internal database row ownership rather than the unique, cryptographic identity of the certificate. An attacker can exploit this flaw by uploading a duplicate record of a target certificate and requesting its revocation, triggering a downstream CA-side revocation and a subsequent denial-of-service (DoS) condition for services relying on the target certificate.

TL;DR

An authorization bypass in Netflix Lemur prior to v1.9.3 allows authenticated users to revoke arbitrary TLS certificates at the upstream CA. By uploading a duplicate metadata record of a victim's certificate, an attacker becomes the owner of that local record and can bypass safety checks to trigger CA-level revocation, resulting in immediate service disruption.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: CWE-639: Authorization Bypass Through User-Controlled Key
Attack Vector: Local API Access (Authenticated User Session)
CVSS v3.1 Base Score: 7.3
EPSS Score: Not available
Exploit Status: Proof of Concept (PoC) available in official repository
CISA KEV Status: Not Listed
Scope Impact: Changed (S:C) - Lemur exploitation leads to external CA revocation

Affected Systems

Netflix Lemur prior to version 1.9.3
Lemur: < 1.9.3 (Fixed in: 1.9.3)

Code Analysis

Commit: 851389a

Fix duplicate row certificate revocation vulnerability and add strict authority validation

@@ -651,6 +651,32 @@
+ authority = data.get("authority")
+ if authority:
+     authority_roles = [x.name for x in authority.roles]
+     if not AuthorityPermission(authority.id, authority_roles).can():
+         return dict(message="You are not authorized to upload a certificate for the specified authority."), 403

Exploit Details

GitHub Security Advisory: GHSA-pxmc-2ffp-8j67 contains comprehensive reproduction steps and the official unit tests showing the verification bypass.

Mitigation Strategies

Upgrade Netflix Lemur to version 1.9.3 or later to enforce strict input checks and identity-level validation during revocation.
Deploy database constraints to ensure uniqueness for 'authority_id' and 'serial' to eliminate application-layer TOCTOU race conditions.
Regularly audit database records for duplicate certificates sharing identical serial numbers and authorities.

Remediation Steps:

Identify the current Netflix Lemur version and plan an update to version 1.9.3.
Run the database cleanup script to locate duplicate records: 'SELECT authority_id, serial, COUNT() FROM certificates GROUP BY authority_id, serial HAVING COUNT() > 1;'
Remove duplicate or orphaned rows identified in step 2, ensuring that only the original, verified records with active endpoints remain.
Apply the v1.9.3 update and verify that the API returns a '409 Conflict' when attempting to upload an existing certificate serial.