CVE-2026-71317: Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority when ADMINONLYAUTHORITYCREATION was false. AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority creation to cryptography-issuer, which used the parent authoritycertificate.privatekey to sign a new intermediate. Any authenticated non-read-only user in that supported configuration could chain a sub-CA to an internal root for which the user held no role. The resulting intermediate could issue trusted certificates and its private key could be used outside Lemur, bypassing normal issuance controls. The fix checks AuthorityPermission on every supplied parent before invoking the issuer. This issue is fixed in version 1.9.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.9.3
Event History
Frequently Asked Questions
Which deployments and users are exposed?
Lemur deployments prior to 1.9.3 are affected only when ADMIN_ONLY_AUTHORITY_CREATION is false. In that configuration, any authenticated user who is not read-only can exploit the issue, including users without a role on the targeted parent authority.
What access does an attacker need to exploit this?
An attacker needs an authenticated Lemur account with non-read-only access and must be able to submit a sub-CA creation request naming a parent authority. No AuthorityPermission on that parent authority is required in the affected configuration.
What is the practical impact of successful exploitation?
A successful attacker can create an intermediate CA chained to an internal root they are not authorized to use. That intermediate can issue trusted certificates, and its private key can be used outside Lemur to bypass normal issuance controls.
What can be done if patching is not immediately possible?
Upgrade Lemur to version 1.9.3, which checks AuthorityPermission for every supplied parent authority before calling the issuer. If upgrading cannot happen immediately, setting ADMIN_ONLY_AUTHORITY_CREATION to true prevents the described non-admin sub-CA creation path.