CVE-2026-71322: Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed cert.privatekey as an argument and recorded a keyview audit event. The bundled JavaTruststoreExportPlugin ignored the key, so the immediate exposure was limited to public certificate material and misleading audit entries, but a future plugin could have consumed the supplied key. The fix passes no private key to plugins that do not require one and confines ownership checks and keyview logging to actual private-key exports. This issue is fixed in version 1.9.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lemurto a version that resolves this vulnerability.Fixed in 1.9.3
Event History
Frequently Asked Questions
Which deployments are exposed in practice?
Lemur installations prior to 1.9.3 are affected when they have an export plugin that declares requires_key = False. The bundled JavaTruststoreExportPlugin matches this condition, but its immediate exposure is limited to public certificate material because it ignores the private-key argument.
What access does an attacker need to exploit this?
An attacker needs low-privileged access sufficient to make the POST export request for a certificate they do not own. No user interaction is required, and the missing ownership check is reached for plugins with requires_key = False.
What should be done if patching is not immediately possible?
Upgrade Lemur to version 1.9.3. If upgrading cannot happen immediately, prevent use of certificate export plugins that declare requires_key = False, especially by users who should not be able to export certificates outside their ownership.
How can audit records help identify potential prior impact?
On affected versions, key_view audit events may have been recorded for exports through plugins that did not actually use a private key. Such events can therefore be misleading and should not by themselves be treated as evidence that private-key material was exported.