CVE-2026-55163 Netflix CVE debrief

Who should care

Administrators and users of Lemur for TLS certificate management, especially those with multiple administrators or users with role-based access, should review and update Lemur to version 1.9.2 or later. They should also restrict role update permissions to administrators only and monitor role changes and access logs for suspicious activity.

Why it matters

The vulnerability in Lemur's role management functionality allows unauthorized role updates, potentially leading to lateral privilege escalation within roles controlling certificate and authority access. This issue requires verification of role update permissions and access logs.

• Potential lateral privilege escalation within roles controlling certificate and authority access
• Unauthorized role updates could deny access by removing legitimate members
• Verification of role update permissions and access logs is necessary

Technical summary

The vulnerability in Lemur's role management functionality allowed non-admin members to add or remove users and rename roles, potentially leading to lateral privilege escalation within roles controlling certificate and authority access. The fix applies the same administrator-only requirement to the PUT handler. The handler passed data[users] and data[name] to service.update, allowing a non-admin member to add or remove other users and rename the role. This enabled lateral privilege grants within roles that control certificate and authority access and could deny access by removing legitimate members. The DELETE handler already required admin_permission, confirming that the weaker PUT authorization was

Defensive priority

Medium priority for systems using Lemur for TLS certificate management, especially those with multiple administrators or users with role-based access.

Recommended defensive actions

• Review and update Lemur to version 1.9.2 or later
• Restrict role update permissions to administrators only
• Monitor role changes and access logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in version 1.9.2 of Lemur. The vulnerability allowed non-admin members to add or remove users and rename roles, potentially leading to lateral privilege escalation within roles controlling certificate and authority access. The issue requires verification of role update permissions and access logs. The fix applies the same administrator-only requirement to the PUT handler. The handler passed data[users] and data[name] to service.update, allowing

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.