{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-71417/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-71417"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["lemur","Lemur (\u003e= 0.5.0, \u003c= 1.9.2)","Lemur (\u003c= 1.9.2)"],"_cs_severities":["high"],"_cs_tags":["certificate-management","authorization-bypass","cve-2026-71417","cloud","ssrf","vulnerability","cve-2026-70666"],"_cs_type":"advisory","_cs_vendors":["Netflix"],"content_html":"\u003cp\u003eLemur (\u0026lt;= 1.9.2) contains a critical authorization bypass vulnerability, identified as CVE-2026-71417, which permits any authenticated user with non-read-only permissions to revoke production certificates. The vulnerability stems from an insecure certificate upload workflow that allows users to supply external identifiers (like \u003ccode\u003ebody\u003c/code\u003e or \u003ccode\u003eexternal_id\u003c/code\u003e) without validating \u003ccode\u003eAuthorityPermission\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eBecause the Lemur database lacks uniqueness constraints on these identifiers, an attacker can create a duplicate certificate record for a target production certificate. When the attacker initiates a revocation on this newly created, attacker-owned duplicate, the application's authorization logic bypasses the ownership check. Furthermore, because the duplicate record has no associated endpoints in the Lemur database, the safety mechanism designed to prevent the revocation of active production certificates is entirely bypassed. This allows an attacker to interact with the issuing CA using the CA's stored credentials to revoke legitimate, live certificates, facilitating mass denial-of-service (DoS) of TLS-protected infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker queries the API (e.g., \u003ccode\u003eGET /api/1/certificates/\u0026lt;ID\u0026gt;\u003c/code\u003e) to obtain the \u003ccode\u003ebody\u003c/code\u003e, \u003ccode\u003eauthority.id\u003c/code\u003e, and \u003ccode\u003eexternal_id\u003c/code\u003e of a target production certificate.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the \u003ccode\u003ePOST /api/1/certificates/upload\u003c/code\u003e endpoint to create a new certificate record in the Lemur database.\u003c/li\u003e\n\u003cli\u003eThe attacker provides the target's stolen metadata in the upload request; Lemur accepts this as a new record because it lacks uniqueness constraints on \u003ccode\u003ebody\u003c/code\u003e or \u003ccode\u003eexternal_id\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker is now the creator/owner of the new, duplicate database record, which satisfies the \u003ccode\u003eg.current_user != cert.user\u003c/code\u003e authorization check in \u003ccode\u003eviews.py\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker calls \u003ccode\u003ePUT /api/1/certificates/\u0026lt;DUP_ID\u0026gt;/revoke\u003c/code\u003e on the duplicate certificate record.\u003c/li\u003e\n\u003cli\u003eThe system checks for existing endpoints associated with the record; since the duplicate record has none, the safety check is bypassed.\u003c/li\u003e\n\u003cli\u003eThe Lemur issuer plugin retrieves the CA credentials and invokes the CA's revocation API using the \u003ccode\u003ebody\u003c/code\u003e or \u003ccode\u003eexternal_id\u003c/code\u003e provided by the attacker.\u003c/li\u003e\n\u003cli\u003eThe issuing CA processes the revocation, rendering the target production certificate invalid.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privileged authenticated user to perform fleet-wide revocation of TLS certificates. This results in an immediate denial-of-service for all services using the revoked certificates. Given the ability to iterate through available certificate IDs via the API, the impact can extend to entire organizations, affecting both internal and external-facing TLS-secured endpoints.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize patching the Lemur instance to a version containing the remediation for CVE-2026-71417. Detection teams should monitor for anomalous usage of the certificate upload and revocation endpoints.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Lemur package to a version beyond 1.9.2 immediately.\u003c/li\u003e\n\u003cli\u003eImplement a database-level uniqueness constraint on the \u003ccode\u003e(authority_id, serial)\u003c/code\u003e or \u003ccode\u003ebody\u003c/code\u003e fields for certificate records to prevent duplicate aliasing.\u003c/li\u003e\n\u003cli\u003eAudit access logs for users performing rapid sequences of certificate uploads followed by revocation calls.\u003c/li\u003e\n\u003cli\u003eRestrict the \u003ccode\u003ePOST /api/1/certificates/upload\u003c/code\u003e and \u003ccode\u003ePUT /api/1/certificates/\u0026lt;ID\u0026gt;/revoke\u003c/code\u003e endpoints to ensure that \u003ccode\u003eAuthorityPermission\u003c/code\u003e is validated regardless of row ownership.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T20:57:00Z","date_published":"2026-08-18T20:56:29Z","id":"https://feed.craftedsignal.io/briefs/2026-08-lemur-cert-revocation/","summary":"An authorization bypass vulnerability in Lemur allows authenticated users to revoke arbitrary certificates by creating duplicate certificate records and bypassing ownership and endpoint-attached safeguards.","title":"Authorization Bypass in Lemur Leading to Unauthorized Certificate Revocation","url":"https://feed.craftedsignal.io/briefs/2026-08-lemur-cert-revocation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-71417","version":"https://jsonfeed.org/version/1.1"}