CVE-2026-71308

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as replaced. The victim was then excluded from get_all_pending_reissue, and certificate_rotate could deploy the attacker certificate to endpoints serving the victim. An authenticated non-read-only user could target certificates for which the user had no ownership or role, suppress lifecycle automation, and cause fleet-wide TLS disruption or unauthorized substitution. The fix authorizes every referenced replacement certificate before mutation. This issue is fixed in version 1.9.3.

• CWE-639
• CWE-862

• https://github.com/Netflix/lemur/commit/286874535160952143b0afe2d356642669f9d4c6
• https://github.com/Netflix/lemur/releases/tag/v1.9.3
• https://github.com/Netflix/lemur/security/advisories/GHSA-cfh6-pv5c-38jv
• https://github.com/Netflix/lemur/security/advisories/GHSA-cfh6-pv5c-38jv

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71293Statamic CMS's user-augmentation resolver, AugmentedUser::ge…6.2
• CVE-2026-71294Cotonti CMS's Comments plugin deserializes user-supplied dat…7.6
• CVE-2026-7130A flaw has been found in SourceCodester Pharmacy Sales and I…7.3
• CVE-2026-71300Improper input validation vulnerability in Apache Camel Atmo…9.8
• CVE-2026-71303Lemur manages TLS certificate creation. Prior to 1.9.3, _val…7.7
• CVE-2026-71307Lemur manages TLS certificate creation. Prior to 1.9.3, GET …7.7
• CVE-2026-71309rclone is a command-line program to sync files and directori…8.6
• CVE-2026-7131A vulnerability has been found in code-projects Online Lot R…7.3
• CVE-2026-71310rclone is a command-line program to sync files and directori…5.9
• CVE-2026-71311rclone is a command-line program to sync files and directori…6.4
• CVE-2026-71312rclone is a command-line program to sync files and directori…8
• CVE-2026-71313rclone is a command-line program to sync files and directori…6.9