Subordinate CA Creation Vulnerability in Lemur by Netflix

CVE-2026-71317

What is CVE-2026-71317?

The vulnerability in Lemur allows an authenticated user, without proper permissions, to create a subordinate Certificate Authority (sub-CA). Prior to version 1.9.3, the process of creating a sub-CA through POST /api/1/authorities with type=subca did not enforce AuthorityPermission checks on the parent authority when certain conditions were met. This flaw enables a non-read-only user to take advantage of the system and link a sub-CA to an internal root authority without necessary roles, granting the ability to issue trusted certificates. The risk posed is that the private key for the newly created intermediate can be utilized outside Lemur's intended control, circumventing established security protocols. The issue has been rectified in version 1.9.3, which implements strict AuthorityPermission verification for all provided parent authorities.

References