CVE-2026-71317

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71317", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-05T18:14:42.064Z", "datePublished": "2026-08-18T19:06:27.618Z", "dateUpdated": "2026-08-19T19:21:56.406Z"}, "containers": {"cna": {"title": "Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Netflix/lemur/security/advisories/GHSA-g7p5-89mh-248h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Netflix/lemur/security/advisories/GHSA-g7p5-89mh-248h"}, {"name": "https://github.com/Netflix/lemur/commit/8669011203ca3dd89d9e39bab9ef6850eca723f9", "tags": ["x_refsource_MISC"], "url": "https://github.com/Netflix/lemur/commit/8669011203ca3dd89d9e39bab9ef6850eca723f9"}, {"name": "https://github.com/Netflix/lemur/releases/tag/v1.9.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/Netflix/lemur/releases/tag/v1.9.3"}], "affected": [{"vendor": "Netflix", "product": "lemur", "versions": [{"version": "< 1.9.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T19:06:27.618Z"}, "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMIN_ONLY_AUTHORITY_CREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority creation to cryptography-issuer, which used the parent authority_certificate.private_key to sign a new intermediate. Any authenticated non-read-only user in that supported configuration could chain a sub-CA to an internal root for which the user held no role. The resulting intermediate could issue trusted certificates and its private key could be used outside Lemur, bypassing normal issuance controls. The fix checks AuthorityPermission on every supplied parent before invoking the issuer. This issue is fixed in version 1.9.3."}], "source": {"advisory": "GHSA-g7p5-89mh-248h", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-g7p5-89mh-248h", "tags": ["not-applicable"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T15:17:29.453382Z", "id": "CVE-2026-71317", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T19:21:56.406Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71317", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T15:17:29.453382Z"}}}], "references": [{"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-g7p5-89mh-248h", "tags": ["not-applicable"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T15:17:49.796Z"}}], "cna": {"title": "Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority", "source": {"advisory": "GHSA-g7p5-89mh-248h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Netflix", "product": "lemur", "versions": [{"status": "affected", "version": "< 1.9.3"}]}], "references": [{"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-g7p5-89mh-248h", "name": "https://github.com/Netflix/lemur/security/advisories/GHSA-g7p5-89mh-248h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Netflix/lemur/commit/8669011203ca3dd89d9e39bab9ef6850eca723f9", "name": "https://github.com/Netflix/lemur/commit/8669011203ca3dd89d9e39bab9ef6850eca723f9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Netflix/lemur/releases/tag/v1.9.3", "name": "https://github.com/Netflix/lemur/releases/tag/v1.9.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMIN_ONLY_AUTHORITY_CREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority creation to cryptography-issuer, which used the parent authority_certificate.private_key to sign a new intermediate. Any authenticated non-read-only user in that supported configuration could chain a sub-CA to an internal root for which the user held no role. The resulting intermediate could issue trusted certificates and its private key could be used outside Lemur, bypassing normal issuance controls. The fix checks AuthorityPermission on every supplied parent before invoking the issuer. This issue is fixed in version 1.9.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T19:06:27.618Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71317", "state": "PUBLISHED", "dateUpdated": "2026-08-19T19:21:56.406Z", "dateReserved": "2026-08-05T18:14:42.064Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T19:06:27.618Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "lemur", "vendor": "Netflix", "versions": [{"status": "affected", "version": "< 1.9.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMIN_ONLY_AUTHORITY_CREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority creation to cryptography-issuer, which used the parent authority_certificate.private_key to sign a new intermediate. Any authenticated non-read-only user in that supported configuration could chain a sub-CA to an internal root for which the user held no role. The resulting intermediate could issue trusted certificates and its private key could be used outside Lemur, bypassing normal issuance controls. The fix checks AuthorityPermission on every supplied parent before invoking the issuer. This issue is fixed in version 1.9.3."}, {"lang": "es", "value": "Lemur gestiona la creaci\u00f3n de certificados TLS. Antes de la versi\u00f3n 1.9.3, POST /API/1/authorities con type=subca no requer\u00eda AuthorityPermission en la autoridad padre cuando ADMIN_ONLY_AUTHORITY_CREATION era falso. AssociatedAuthoritySchema resolv\u00eda el padre proporcionado por el llamador y lo pasaba a trav\u00e9s de la creaci\u00f3n de autoridad a cryptography-issuer, que utilizaba la clave privada de authority_certificate del padre para firmar un nuevo intermedio. Cualquier usuario autenticado no de solo lectura en esa configuraci\u00f3n compatible pod\u00eda encadenar una sub-CA a una ra\u00edz interna para la cual el usuario no ten\u00eda ning\u00fan rol. El intermedio resultante pod\u00eda emitir certificados de confianza y su clave privada pod\u00eda utilizarse fuera de Lemur, eludiendo los controles de emisi\u00f3n normales. La soluci\u00f3n verifica AuthorityPermission en cada padre suministrado antes de invocar al emisor. Este problema est\u00e1 solucionado en la versi\u00f3n 1.9.3."}], "id": "CVE-2026-71317", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71317", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T15:17:29.453382Z", "version": "2.0.3"}}]}, "published": "2026-08-18T20:17:23.910", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Netflix/lemur/commit/8669011203ca3dd89d9e39bab9ef6850eca723f9"}, {"source": "security-advisories@github.com", "url": "https://github.com/Netflix/lemur/releases/tag/v1.9.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/Netflix/lemur/security/advisories/GHSA-g7p5-89mh-248h"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Netflix/lemur/security/advisories/GHSA-g7p5-89mh-248h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.9.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "lemur", "source": "cna", "vendor": "Netflix"}, "product": "lemur", "vendor": "netflix"}], "created": "2026-08-18T20:45:04.333242+00:00", "updated": "2026-08-18T21:00:04.570348+00:00", "vendors": ["netflix", "netflix$PRODUCT$lemur"]}