CVE-2026-71308: Missing Authorization and Lifecycle Hijacking in Netflix Lemur

Vulnerability ID: CVE-2026-71308
CVSS Score: 8.1
Published: 2026-08-18

Netflix Lemur before 1.9.3 contains a missing authorization vulnerability (CWE-862, CWE-639) when handling certificate creation, upload, or modification. Authenticated non-read-only users can manipulate the replaces parameter to silence expiration notifications and hijack certificate rotation tasks for arbitrary targets, leading to unauthorized TLS certificate deployment and traffic interception.

TL;DR

Missing authorization in Netflix Lemur's certificate replacement logic allows standard users to hijack TLS certificate rotation and silence expiration alerts.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-862 / CWE-639
Attack Vector: Network (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
CVSS Score: 8.1 (High)
Exploit Status: poc
CISA KEV Status: Not Listed

Affected Systems

Netflix Lemur
Lemur: >= 0.5.0, < 1.9.3 (Fixed in: 1.9.3)

Code Analysis

Commit: 2868745

Enforce authorization checks during certificate replacement processing

# Patch diff implemented in lemur/certificates/service.py and lemur/certificates/views.py

Mitigation Strategies

Upgrade Netflix Lemur to version 1.9.3 or higher
Restrict standard user access to certificate write and edit endpoints
Regularly audit active certificate replaces relationships in the Lemur database

Remediation Steps:

Identify and catalog all active Netflix Lemur deployments
Apply the security update to upgrade Lemur to version 1.9.3
Verify that current user accounts follow the principle of least privilege
Execute database queries to audit historical replacements for unauthorized mapping configurations