PT-2026-80651

Summary Repo under test: https://github.com/Netflix/lemur PUT /api/1/certificates//revoke authorizes the caller against the Lemur database row creator == current user, or CertificatePermission over the row's roles rather than the underlying CA-side certificate identity. Separately, POST...

Authorization Bypass Through User-Controlled Key

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the upload and revoke. An attacker can cause unauthorized revocation of certificates at the certificate authority by...

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Summary Repo under test: https://github.com/Netflix/lemur PUT /api/1/certificates//revoke authorizes the caller against the Lemur database row creator == current user, or CertificatePermission over the row's roles rather than the underlying CA-side certificate identity. Separately, POST...

GHSA-PXMC-2FFP-8J67 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Summary Repo under test: https://github.com/Netflix/lemur PUT /api/1/certificates//revoke authorizes the caller against the Lemur database row creator == current user, or CertificatePermission over the row's roles rather than the underlying CA-side certificate identity. Separately, POST...

GHSA-F3QQ-49M6-RW8F Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 validaterevocationurl in lemur /certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback,...

CVE-2026-71417

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...

CVE-2026-71417

In Lemur before 1.9.3, a non-read-only user could upload a duplicate certificate row bypassing CertificatePermission, then revoke it via PUT /api/1/certificates//revoke, causing issuer plugins to revoke the real CA-side certificate and causing fleet-wide TLS denial of service. Fixed in 1.9.3. No ...

CVE-2026-71417 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...

CVE-2026-71417 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...

EUVD-2026-61161

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...

CVE-2026-71417 Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authorityid, serial, or externalid without requiring permission on the underlying authority. PUT /api/1/certificates//revo...

CVE-2026-70667 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)

Lemur manages TLS certificate creation. Prior to 1.9.3, validaterevocationurl in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, ...

CVE-2026-70667

Netflix Lemur prior to 1.9.3 contains a bypass of its SSRF mitigation in _validate_revocation_url (lemur/certificates/verify.py). Two vectors exist: (1) the CRL requests.get call follows HTTP redirects without re-validating each Location target, allowing an attacker-controlled public URL to redir...

CVE-2026-70667 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)

Lemur manages TLS certificate creation. Prior to 1.9.3, validaterevocationurl in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, ...

PT-2026-77286

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3 Description An issue exists where a non-read-only user can create a duplicate record via the 'POST /api/1/certificates/upload' endpoint by using another certificate body, authority id, serial, or external id witho...

PT-2026-80301

Summary Repo under test: https://github.com/Netflix/lemur PUT /api/1/certificates//revoke authorizes the caller against the Lemur database row creator == current user, or CertificatePermission over the row's roles rather than the underlying CA-side certificate identity. Separately, POST...

io.netty/netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack

A flaw was found in Netty. The OcspClient component fails to validate that the Certificate ID in an Online Certificate Status Protocol OCSP response matches the requested Certificate ID. This vulnerability allows a remote attacker to bypass certificate revocation checks by presenting a legitimate...

EulerOS 2.0 SP13 : shim (EulerOS-SA-2026-3000)

According to the versions of the shim package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CR...

MGASA-2026-0323 Updated tomcat packages fix security vulnerabilities

The updated packages fix security vulnerabilities: XSS in number guess example. CVE-2026-50229 Bad ornext processing in RewriteValve. CVE-2026-53404 Invalid CRL configuration doesn't trigger failure for FFM Connector. CVE-2026-53434 Logged effective web.xml is incomplete. CVE-2026-55276...

Malicious code in certificates-revocation-sw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3037d3d739bf6d25fbb06a613915278de458d3b90547bdbf11b2710b7d88d82a The package's index.js unconditionally loads bootstrap.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hos...