Detections
Analytics

SCA: security update for lemur (GHSA-g7p5-89mh-248h)

medium Tenable Cloud Security Plugin ID 446094

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not
 require AuthorityPermission on the parent authority when ADMIN_ONLY_AUTHORITY_CREATION was false.
 AssociatedAuthoritySchema resolved the caller-supplied parent and passed it through authority creation to
 cryptography-issuer, which used the parent authority_certificate.private_key to sign a new intermediate.
 Any authenticated non-read-only user in that supported configuration could chain a sub-CA to an internal
 root for which the user held no role. The resulting intermediate could issue trusted certificates and its
 private key could be used outside Lemur, bypassing normal issuance controls. The fix checks
 AuthorityPermission on every supplied parent before invoking the issuer. This issue is fixed in version
 1.9.3. (CVE-2026-71317)

Solution

Update the lemur library and its related packages to version 1.9.3 or later.

See Also

https://github.com/advisories/GHSA-g7p5-89mh-248h

Plugin Details

Severity: Medium

ID: 446094

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/19/2026

Updated: 8/19/2026

Risk Information

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:N

CVSS Score Source: CVE-2026-71317

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/18/2026

Vulnerability Publication Date: 8/18/2026

Reference Information

CVE: CVE-2026-71317

cwe: CWE-862