Netflix Lemur vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 202616

Newest CVEs

• CVE-2026-71417

  Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

  Netflix · lemur

  High7.3
• CVE-2026-71322

  Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False

  Netflix · lemur

  Medium4.3
• CVE-2026-71317

  Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority

  Netflix · lemur

  Medium6.5
• CVE-2026-70666

  Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

  Netflix · lemur

  High7.4
• CVE-2026-71303

  Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

  Netflix · lemur

  High7.7
• CVE-2026-71307

  Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

  Netflix · lemur

  High7.7
• CVE-2026-71308

  Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

  Netflix · lemur

  High8.1
• CVE-2026-70667

  Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)

  Netflix · lemur

  Medium6.3
• CVE-2026-55164

  Lemur: Plaintext password storage in Lemur user-update path

  Netflix · lemur

  Medium4.9
• CVE-2026-55162

  Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates

  Netflix · lemur

  Medium6.3