Authorization Bypass in Lemur Leading to Unauthorized Certificate Revocation

Lemur (<= 1.9.2) contains a critical authorization bypass vulnerability, identified as CVE-2026-71417, which permits any authenticated user with non-read-only permissions to revoke production certificates. The vulnerability stems from an insecure certificate upload workflow that allows users to supply external identifiers (like body or external_id) without validating AuthorityPermission.

Because the Lemur database lacks uniqueness constraints on these identifiers, an attacker can create a duplicate certificate record for a target production certificate. When the attacker initiates a revocation on this newly created, attacker-owned duplicate, the application's authorization logic bypasses the ownership check. Furthermore, because the duplicate record has no associated endpoints in the Lemur database, the safety mechanism designed to prevent the revocation of active production certificates is entirely bypassed. This allows an attacker to interact with the issuing CA using the CA's stored credentials to revoke legitimate, live certificates, facilitating mass denial-of-service (DoS) of TLS-protected infrastructure.

Attack Chain

1. The attacker queries the API (e.g., GET /api/1/certificates/<ID>) to obtain the body, authority.id, and external_id of a target production certificate.
2. The attacker uses the POST /api/1/certificates/upload endpoint to create a new certificate record in the Lemur database.
3. The attacker provides the target's stolen metadata in the upload request; Lemur accepts this as a new record because it lacks uniqueness constraints on body or external_id.
4. The attacker is now the creator/owner of the new, duplicate database record, which satisfies the g.current_user != cert.user authorization check in views.py.
5. The attacker calls PUT /api/1/certificates/<DUP_ID>/revoke on the duplicate certificate record.
6. The system checks for existing endpoints associated with the record; since the duplicate record has none, the safety check is bypassed.
7. The Lemur issuer plugin retrieves the CA credentials and invokes the CA's revocation API using the body or external_id provided by the attacker.
8. The issuing CA processes the revocation, rendering the target production certificate invalid.

Impact

Successful exploitation allows a low-privileged authenticated user to perform fleet-wide revocation of TLS certificates. This results in an immediate denial-of-service for all services using the revoked certificates. Given the ability to iterate through available certificate IDs via the API, the impact can extend to entire organizations, affecting both internal and external-facing TLS-secured endpoints.

Recommendation

Prioritize patching the Lemur instance to a version containing the remediation for CVE-2026-71417. Detection teams should monitor for anomalous usage of the certificate upload and revocation endpoints.

• Upgrade the Lemur package to a version beyond 1.9.2 immediately.
• Implement a database-level uniqueness constraint on the (authority_id, serial) or body fields for certificate records to prevent duplicate aliasing.
• Audit access logs for users performing rapid sequences of certificate uploads followed by revocation calls.
• Restrict the POST /api/1/certificates/upload and PUT /api/1/certificates/<ID>/revoke endpoints to ensure that AuthorityPermission is validated regardless of row ownership.