CVE-2026-48508 Netflix CVE debrief

Who should care

Administrators and users of Lemur should assess their configurations and consider upgrading to version 1.9.1. Defenders should prioritize verifying their Lemur configurations and upgrading to version 1.9.1 if necessary. This includes reviewing and restricting access to sensitive operations, and verifying that configuration flags are properly set.

Why it matters

This vulnerability in Lemur's permission system could allow authenticated users to perform unauthorized actions, including creating Certificate Authorities, uploading certificates, and creating notifications. Defenders should verify their configurations and upgrade to version 1.9.1 if necessary.

• Potential unauthorized creation of root Certificate Authorities.
• Potential unauthorized upload of arbitrary certificates.
• Potential unauthorized creation or editing of notifications that could lead to SSRF.
• Potential unauthorized creation of domain entries.

Technical summary

The vulnerability is in the Lemur auth/permissions.py file, specifically with StrictRolePermission and AuthorityCreatorPermission. When ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset (defaulting to False), the application incorrectly grants permissions. This issue is fixed in version 1.9.1. The vulnerability could allow authenticated users to perform unauthorized actions, including creating Certificate Authorities, uploading certificates, and creating notifications that could lead to SSRF.

Defensive priority

Defenders should prioritize verifying their Lemur configurations and upgrading to version 1.9.1 if necessary.

Recommended defensive actions

• Verify Lemur configuration flags are properly set.
• Upgrade to Lemur version 1.9.1 or later.
• Review and restrict access to sensitive operations.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The issue arises from how Lemur handles permissions when certain configuration flags are not set. This could lead to unauthorized access to sensitive operations. The vulnerability is in the Lemur auth/permissions.py file, specifically with StrictRolePermission and AuthorityCreatorPermission. When ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset (defaulting to False), the application incorrectly grants permissions. Defenders should verify their Lemur configurations and upgrade to version 1.9.1 if necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.