p PatchFirst

CVE-2026-71308

CVE-2026-71308 · Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as replaced. The victim was then excluded from get_all_pending_reissue, and certificate_rotate could deploy the attacker certificate to endpoints serving the victim. An authenticated non-read-only user could target certificates for which the user had no ownership or role, suppress lifecycle automation, and cause fleet-wide TLS disruption or unauthorized substitution. The fix authorizes every referenced replacement certificate before mutation. This issue is fixed in version 1.9.3.

CVSS 8.1 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • lemur

    Versions
    • >= 0.5.0, < 1.9.3: Affected

    No fix published

  • lemur PyPI

    Versions
    • 0.11.0
    • 0.8.0
    • 0.8.1
    • 0.9.0
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.7.0
    • 1.8.0
    • 1.8.1
    • 1.8.2
    • 1.9.0
    • 1.9.1
    • 1.9.2
    Affected ranges
    • ECOSYSTEM: ≥ 0.5.0, < 1.9.3

    Update to 1.9.3

Original sources

Check your server →