TLS Certificate Management Flaw in Lemur by Netflix

CVE-2026-71322

What is CVE-2026-71322?

A vulnerability exists in Lemur's TLS certificate export functionality where the ownership check for CertificatePermission is mishandled. In versions prior to 1.9.3, if a plugin declared 'requires_key' as false, it bypassed essential permission validations, potentially exposing sensitive private keys during certificate export operations. While this flaw primarily affects public certificate material and may create misleading audit logs, future plugins could exploit the provided keys. This issue has been addressed in version 1.9.3, which now properly restricts private key access and enhances security by ensuring only the relevant plugins can manage sensitive key exports.

References