CVE-2026-71317: Missing Authorization in Netflix Lemur Allows Unauthorized Subordinate CA Creation

Vulnerability ID: CVE-2026-71317
CVSS Score: 6.5
Published: 2026-08-18

CVE-2026-71317 is a critical Broken Object-Level Authorization (BOLA) / Missing Authorization vulnerability in Netflix Lemur versions prior to 1.9.3. When the self-service authority creation option is enabled (ADMIN_ONLY_AUTHORITY_CREATION = False), Lemur allows authenticated non-read-only users to request the creation of a subordinate Certificate Authority (sub-CA) chained to any internal parent authority, even if the requesting user lacks administrative or usage permissions over that parent CA. This allows attackers to generate subordinate CAs signed by trusted root certificates, exposing private keys and compromising the organizational PKI trust chain.

TL;DR

An authorization bypass in Netflix Lemur (< 1.9.3) allows low-privileged users to create unauthorized subordinate CAs chained to any trusted root CA, bypassing normal certificate policies and exposing the PKI private keys.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-862
• Attack Vector: Local
• CVSS v3.1 Score: 6.5
• Exploit Status: Proof of Concept (PoC)
• CISA KEV Status: Not Listed
• Impact: High Integrity Compromise
• Remediation Status: Patched

Affected Systems

• Netflix Lemur versions prior to 1.9.3
• Lemur: < 1.9.3 (Fixed in: 1.9.3)

Code Analysis

Commit: 8669011

Check AuthorityPermission on parent authority during creation

Mitigation Strategies

• Upgrade Netflix Lemur to version 1.9.3 or higher to enforce parent authority checks.
• Configure ADMIN_ONLY_AUTHORITY_CREATION = True in lemur.conf.py as a temporary workaround to disable self-service CA creation.
• Conduct regular audits of the Lemur certificate inventory and verify authority trust chains.

Remediation Steps:

1. Identify all current Netflix Lemur installations and verify their version numbers.
2. Apply the patch or upgrade to version 1.9.3 using your environment's deployment process.
3. If patching is delayed, modify the configuration file lemur.conf.py to ensure ADMIN_ONLY_AUTHORITY_CREATION = True.
4. Restart the Lemur services to apply the updated configuration.
5. Audit existing certificate database tables and logs for any unauthorized subordinate CAs generated by non-admin accounts.

References

• GHSA-g7p5-89mh-248h Advisory
• Lemur Fix Commit
• NVD - CVE-2026-71317
• CVE.org Record

Read the full report for CVE-2026-71317 on our website for more details including interactive diagrams and full exploit analysis.