SCA: security update for lemur (GHSA-pxmc-2ffp-8j67)

high Tenable Cloud Security Plugin ID 446077

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-
read-only user to create a duplicate row using another certificate body, authority_id, serial, or
external_id without requiring permission on the underlying authority. PUT /api/1/certificates//revoke
authorized the caller against only the selected Lemur row, so the creator of the duplicate bypassed
CertificatePermission. The duplicate had no cert.endpoints, which also bypassed the safeguard that
prevents revocation of deployed certificates. Issuer plugins then revoked the real CA-side certificate
using certificate.body or external_id under the stored authority credentials. An attacker could therefore
revoke arbitrary managed certificates and cause fleet-wide TLS denial of service. The fix rejects
duplicate authority_id and serial identities, requires authority access on upload, and checks every
matching row during revocation. This issue is fixed in version 1.9.3. (CVE-2026-71417)

Solution

Update the lemur library and its related packages to version 1.9.3 or later.

Plugin Details

Severity: High

ID: 446077

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/19/2026

Updated: 8/19/2026

Risk Information

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5.2

Temporal Score: 3.8

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:P/A:C

CVSS Score Source: CVE-2026-71417

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/18/2026

Vulnerability Publication Date: 8/18/2026

Reference Information

CVE: CVE-2026-71417

cwe: CWE-639

Detections

Analytics