Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

🗓️ 19 Aug 2026 11:56:28Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 2 Views

Lemur allows any authenticated user to replace arbitrary certificates via unchecked replaces[] array, suppressing notifications and hijacking auto-rotation.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-71308	18 Aug 202622:35	–	circl
CVE	CVE-2026-71308	18 Aug 202619:00	–	cve
Cvelist	CVE-2026-71308 Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates	18 Aug 202619:00	–	cvelist
EUVD	EUVD-2026-61152	18 Aug 202619:00	–	euvd
Github Security Blog	Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates	18 Aug 202620:51	–	github
NVD	CVE-2026-71308	18 Aug 202620:17	–	nvd
OSV	GHSA-CFH6-PV5C-38JV Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates	18 Aug 202620:51	–	osv
OSV	PYSEC-2026-3675 Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates	19 Aug 202611:56	–	osv
Positive Technologies	PT-2026-77283	18 Aug 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-71308 Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates	18 Aug 202619:00	–	vulnrichment

Vulners

Node

pypi lemurRange0.5.0–1.9.3

Source	Link
github	www.github.com/Netflix/lemur/security/advisories/GHSA-cfh6-pv5c-38jv
github	www.github.com/Netflix/lemur/commit/286874535160952143b0afe2d356642669f9d4c6
github	www.github.com/Netflix/lemur
github	www.github.com/Netflix/lemur/releases/tag/v1.9.3
pypi	www.pypi.org/project/lemur
github	www.github.com/advisories/GHSA-cfh6-pv5c-38jv
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-71308

19 Aug 2026 12:16Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.1

EPSS0.00179

SSVC