← Vulnerability feed

Vulnerability record · CVE-2026-71308 · published 18 August 2026

CVE-2026-71308: Insecure direct object reference vulnerability

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as replaced. The victim was then excluded from get_all_pending_reissue, and certificate_rotate could deploy the attacker certificate to endpoints serving the victim. An authenticated non-read-only user could target certificates for which the user had no ownership or role, suppress lifecycle automation, and cause fleet-wide TLS disruption or unauthorized substitution. The fix authorizes every referenced replacement certificate before mutation. This issue is fixed in version 1.9.3.

8.1 CVSS 3.1 High EPSS 0.32% · top 77.9% CWE-639 · Insecure direct object referenceCWE-862 · Missing authorization Deferred
8.1CVSS 3.1 base score
0.32%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
4References
8 Sep 2026Last modified by NVD

Description

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as replaced. The victim was then excluded from get_all_pending_reissue, and certificate_rotate could deploy the attacker certificate to endpoints serving the victim. An authenticated non-read-only user could target certificates for which the user had no ownership or role, suppress lifecycle automation, and cause fleet-wide TLS disruption or unauthorized substitution. The fix authorizes every referenced replacement certificate before mutation. This issue is fixed in version 1.9.3.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

LinkTags
https://github.com/Netflix/lemur/commit/286874535160952143b0afe2d356642669f9d4c6
https://github.com/Netflix/lemur/releases/tag/v1.9.3
https://github.com/Netflix/lemur/security/advisories/GHSA-cfh6-pv5c-38jv
https://github.com/Netflix/lemur/security/advisories/GHSA-cfh6-pv5c-38jv

Track CVE-2026-71308 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.4CVE-2026-55255Langflow IDOR in responses endpoint allows cross-user flow executionLangflow before 1.9.1 has an insecure direct object reference in the /api/v1/responses endpoint. An authenticated attacker can supply another user's …KEVEPSS 0.89%analysed

Source: NIST National Vulnerability Database (record CVE-2026-71308), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.