CVE-2026-71322

{"id": "CVE-2026-71322", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71322", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T18:03:59.629156Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Netflix", "product": "lemur", "versions": [{"status": "affected", "version": "< 1.9.3"}]}]}], "published": "2026-08-18T20:17:24.073", "references": [{"url": "https://github.com/Netflix/lemur/commit/5683bbea8b10cce07f9a8abf1e4a7d3b2031c585", "source": "security-advisories@github.com"}, {"url": "https://github.com/Netflix/lemur/releases/tag/v1.9.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-4h97-p9wq-chqj", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false bypassed that check, and the handler still passed cert.private_key as an argument and recorded a key_view audit event. The bundled JavaTruststoreExportPlugin ignored the key, so the immediate exposure was limited to public certificate material and misleading audit entries, but a future plugin could have consumed the supplied key. The fix passes no private key to plugins that do not require one and confines ownership checks and key_view logging to actual private-key exports. This issue is fixed in version 1.9.3."}, {"lang": "es", "value": "Lemur gestiona la creaci\u00f3n de certificados TLS. Antes de la versi\u00f3n 1.9.3, CertificateExport colocaba su verificaci\u00f3n de propiedad de CertificatePermission dentro de la rama plugin.requires_key para POST /api/1/certificates//export. Un plugin que declaraba requires_key como falso elud\u00eda esa verificaci\u00f3n, y el gestor a\u00fan pasaba cert.private_key como argumento y registraba un evento de auditor\u00eda key_view. El JavaTruststoreExportPlugin incluido ignoraba la clave, por lo que la exposici\u00f3n inmediata se limitaba a material de certificado p\u00fablico y entradas de auditor\u00eda enga\u00f1osas, pero un plugin futuro podr\u00eda haber consumido la clave suministrada. La soluci\u00f3n no pasa ninguna clave privada a los plugins que no la requieren y confina las verificaciones de propiedad y el registro de key_view a las exportaciones reales de claves privadas. Este problema est\u00e1 solucionado en la versi\u00f3n 1.9.3."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "security-advisories@github.com"}