CVE-2026-71322: netflix lemur Missing Authorization

Vulnerability summary

CVE-2026-71322 is a medium (CVSS 4.3) Missing Authorization vulnerability in netflix lemur. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.2% of scored vulnerabilities.

Timeline

1. 18-08-2026
   PublishedVulnerability first disclosed.
2. 19-08-2026
   Last modifiedVulnerability information updated.

Description

Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false bypassed that check, and the handler still passed cert.private_key as an argument and recorded a key_view audit event. The bundled JavaTruststoreExportPlugin ignored the key, so the immediate exposure was limited to public certificate material and misleading audit entries, but a future plugin could have consumed the supplied key. The fix passes no private key to plugins that do not require one and confines ownership checks and key_view logging to actual private-key exports. This issue is fixed in version 1.9.3.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.