Netflix Lemur

• CVE-2026-71417 High 7.3 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it 0.1%
• CVE-2026-71322 Medium 4.3 Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False 0.2%
• CVE-2026-71317 Medium 6.5 Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority 0.1%
• CVE-2026-70666 High 7.4 Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs 0.2%
• CVE-2026-71303 High 7.7 Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist 0.3%
• CVE-2026-71307 High 7.7 Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API 0.3%
• CVE-2026-71308 High 8.1 Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates 0.3%
• CVE-2026-70667 Medium 6.3 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162) 0.2%
• CVE-2026-55164 Medium 4.9 Lemur: Plaintext password storage in Lemur user-update path 0.3%
• CVE-2026-55162 Medium 6.3 Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates 0.2%
• CVE-2026-55166 Critical 9.9 Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR 0.3%
• CVE-2026-55163 Medium 6.3 Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership 0.2%
• CVE-2026-55165 Medium 4.8 Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure 0.2%
• CVE-2026-48508 High 8.8 Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission 0.3%
• CVE-2026-44305 Medium 6.8 Lemur: LDAP TLS certificate verification globally disabled enables credential interception 0.1%
• CVE-2026-44304 High 8.1 Lemur: LDAP Filter Injection enables post-authentication privilege escalation 0.2%
• CVE-2023-30797 High 7.5 Insecure Random Generation in Netflix Lemur 0.8%