CVE-2026-71322: Missing Authorization Check in Netflix Lemur Certificate Export

Netflix Lemur serves as an orchestration platform for TLS/SSL certificate management, providing automated certificate provisioning, tracking, and renewal. It exposes an administrative REST API allowing users to manage, share, and export certificate material. Security boundaries are maintained via role-based access control (RBAC), restricting certificate modification and export operations to the certificate owner or designated administrators.

The vulnerability is classified as CWE-862 (Missing Authorization) and resides in the API endpoint handling certificate exports (POST /api/1/certificates/<certificate_id>/export). The core issue stems from nested logic that binds the execution of authorization checks to specific attributes of the selected export plugin rather than applying the permission check unconditionally to the target resource.

The attack surface is accessible to any authenticated user of the Lemur platform. Exploitation allows unauthorized users to retrieve truststore formats and public certificate data of assets they do not own, potentially disclosing internal network structures, domains, or certificate metadata.

The root cause of CVE-2026-71322 is a control flow defect in lemur/certificates/views.py. During an export operation, Lemur utilizes helper plugins to format the output data (such as JKS truststores or PKCS12 keystores). These plugins declare whether they require access to the certificate's private key via the boolean attribute plugin.requires_key.

In the unpatched code, the conditional block evaluating certificate permission was nested entirely within the scope of an if plugin.requires_key: block. If a plugin set this boolean value to False, the control flow completely bypassed the nested authorization check (CertificatePermission), proceeding directly to the export implementation phase.

Furthermore, the unpatched architecture executed log auditing (key_view) and parameter passing unconditionally outside this conditional branch. This design meant that the private key parameter was still passed to the plugin's export method, and a key_view audit entry was logged, even if the plugin had declared it did not need the private key. This logic flow resulted in false audit trails and potential exposure of sensitive key handles to unauthorized plugins.

An examination of the vulnerable code in lemur/certificates/views.py reveals the flawed logical nesting:

# VULNERABLE CODE PATH
if plugin.requires_key:
    if not cert.private_key:
        return (...)
    else:
        # Permission check nested only here
        if g.current_user != cert.user:
            owner_role = role_service.get_by_name(cert.owner)
            permission = CertificatePermission(owner_role, [x.name for x in cert.roles])
            if not permission.can():
                return (dict(message="Unauthorized"), 403)
 
# Bypassed code block executions
log_service.create(g.current_user, "key_view", certificate=cert)
extension, passphrase, data = plugin.export(
    cert.body, cert.chain, cert.private_key, options
)

The fix introduced in commit 5683bbea8b10cce07f9a8abf1e4a7d3b2031c585 corrects this flow by introducing an isolated private_key variable initialized to None and refactoring the logic structure:

# PATCHED CODE PATH
private_key = None
if plugin.requires_key:
    if not cert.private_key:
        return (...)
 
    # Permission validation is executed whenever requires_key is true
    if g.current_user != cert.user:
        owner_role = role_service.get_by_name(cert.owner)
        permission = CertificatePermission(owner_role, [x.name for x in cert.roles])
        if not permission.can():
            return (dict(message="Unauthorized"), 403)
 
    # Audit logging and key assignment are restricted strictly to this block
    log_service.create(g.current_user, "key_view", certificate=cert)
    private_key = cert.private_key
 
options = data["plugin"]["plugin_options"]
extension, passphrase, data = plugin.export(
    cert.body, cert.chain, private_key, options
)

The patch successfully mitigates the vulnerability by isolating the private key pointer. Because private_key is assigned None for plugins where requires_key = False, no private key is passed into the format handler. Furthermore, actual private key operations are bound directly to the user's role permission check, blocking unauthorized credential leakage.

To exploit this vulnerability, an attacker must possess authenticated API access to the Netflix Lemur target application. The attacker executes the attack using a custom REST request directed at the export endpoint.

First, the attacker identifies a certificate ID of interest (cert_id). The target certificate does not have to belong to the attacker's assigned user role. Second, the attacker generates a POST request to /api/1/certificates/{cert_id}/export specifying an export plugin that does not request private keys, such as java-truststore-jks:

{
  "plugin": {
    "slug": "java-truststore-jks",
    "plugin_options": []
  }
}

Because the requested plugin has requires_key = False, the unpatched Lemur instance skips the CertificatePermission verification check. The handler retrieves the certificate body and public chain, formats them into a Java KeyStore structure, and returns the file payload to the unauthorized user. The transaction completes with an HTTP status 200 OK.

The overall security impact is classified as Medium, yielding a CVSS score of 4.3. The vulnerability does not allow direct remote code execution or structural modifications to certificates. However, it severely degrades the confidentiality of public key infrastructure metadata and impairs audit log integrity.

Unauthorized export of public certificate structures allows actors to map out trusted target hostnames, subdomains, and certificate properties. Additionally, on unpatched servers, a successful exploit triggers a false positive key_view audit log entry in the database. This obscures genuine private-key export tracking, leading to audit pollution and making security operations detection efforts unreliable.

A latent risk also exists if a third-party or locally developed export plugin, configured with requires_key = False, internally processes or exfiltrates the third parameter during export. In such cases, unpatched Lemur systems would expose the raw private key parameters directly to the plugin without verifying user authorization.

Remediation requires upgrading Netflix Lemur instances to version 1.9.3 or higher. This release relocates the authorization evaluations and limits private key material to authorized execution scopes.

If immediate software upgrade is not feasible, security engineers should implement temporary workarounds. First, restrict network-level access to the export API endpoints utilizing upstream gateways or Web Application Firewalls (WAF). Allow endpoint interaction only for authenticated administrators.

Second, review customized or third-party export plugins to ensure none declare requires_key = False if they perform caching, logging, or storage of execution arguments. To monitor for past exploitation attempts, audit Lemur logs for occurrences where key_view audit actions are linked to accounts that do not have authorization or owner status over the targeted certificates.