Netflix Lemur
18 CVEs affecting Netflix Lemur. Latest disclosed: 2026-08-18. Critical: 1, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-55166 | Critical | 9.9 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destina… |
CVE-2026-48508 | High | 8.8 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.P… |
CVE-2026-71308 | High | 8.1 | 2026-08-18 | Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers t… |
CVE-2026-44304 | High | 8.1 | 2026-05-12 | Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitize… |
CVE-2026-71307 | High | 7.7 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write… |
CVE-2026-71303 | High | 7.7 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1… |
CVE-2023-30797 | High | 7.5 | 2023-04-19 | Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacke… |
CVE-2015-7764 | High | 7.5 | 2017-08-09 | Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode. |
CVE-2026-70666 | High | 7.4 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and… |
CVE-2026-71417 | High | 7.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another ce… |
CVE-2026-44305 | Medium | 6.8 | 2026-05-12 | Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disa… |
CVE-2026-71317 | Medium | 6.5 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority whe… |
CVE-2026-70667 | Medium | 6.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the l… |
CVE-2026-55163 | Medium | 6.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), wh… |
CVE-2026-55162 | Medium | 6.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded cert… |
CVE-2026-55164 | Medium | 4.9 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/user… |
CVE-2026-55165 | Medium | 4.8 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_token_header to read header_data["alg"] fr… |
CVE-2026-71322 | Medium | 4.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branc… |