These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T20:17:24.237Z and has not been modified since then. The vulnerability in Lemur's certificate management allows a non-read-only user to create a duplicate row using another certificate body, authority_id, serial, or external_id without requiring permission on the underlying authority. This can lea [truncated]
A vulnerability in Lemur's CertificateExport feature allowed plugins that did not require a private key to receive one, bypassing ownership checks and potentially logging misleading audit entries. This issue was addressed in version 1.9.3. The vulnerability involves a flawed implementation of the CertificateExport feature in Lemur, which failed to properly restrict private key access to plugins that decla [truncated]
CVE-2026-71317 is a vulnerability in Lemur's TLS certificate creation process. Prior to version 1.9.3, an authenticated non-read-only user could create a sub-CA chained to an internal root without proper permissions, allowing them to issue trusted certificates and use the private key outside of Lemur. This issue could impact defenders who manage Lemur deployments, as they need to assess their exposure and [truncated]
An authenticated non-read-only user could target certificates for which the user had no ownership or role, suppress lifecycle automation, and cause fleet-wide TLS disruption or unauthorized substitution. This issue arises from a lack of CertificatePermission checks in Lemur versions 0.5.0 to 1.9.2, allowing an attacker to disable victim certificate notifications and mark them as replaced. The victim certi [truncated]
A vulnerability in Lemur prior to version 1.9.3 allows read-only users to retrieve sensitive credentials for remote certificate-deployment hosts due to insufficient permission checks on GET /api/1/destinations and GET /api/1/destinations/ endpoints. This issue arises from the system's failure to enforce adequate access controls, potentially exposing sensitive information. Administrators and security teams [truncated]
A vulnerability in Lemur prior to version 1.9.3 allows users with authority roles to bypass security checks and potentially expose internal services or cloud metadata. The issue arises from the improper validation of ACME directory URLs when updating authority options. This could allow unauthorized changes and potentially expose internal services or cloud metadata. Defenders should assess their exposure a [truncated]
A vulnerability in Lemur's TLS certificate creation management allowed an authority-role member to update the ACME server URL without revalidation, potentially leading to JWS-signed requests to internal services or cloud metadata endpoints. This issue was fixed in version 1.9.3. The vulnerability allowed an attacker to manipulate ACME directory and order responses, which could lead to unauthorized access [truncated]
PatchSiren debrief for CVE-2026-70667: Lemur TLS certificate creation vulnerability allows an attacker to induce blind internal requests via CRL or OCSP URL validation. Operators of Lemur instances should assess exposure, verify remediation, and monitor for unusual internal requests. The vulnerability is caused by the _validate_revocation_url function in lemur/certificates/verify.py being vulnerable to re [truncated]
Authenticated users in Lemur prior to 1.9.2 could manipulate ACME authority URLs to make backend requests, potentially exposing cloud credentials and private key material. The issue is fixed in version 1.9.2 with ACME_DIRECTORY_HOST_ALLOWLIST validation and enriched key-export audit events. This vulnerability allows attackers to target cloud instance metadata or internal services from the Lemur network co [truncated]
A defense-in-depth gap was found in Lemur's JWT verifier prior to version 1.9.2. The verifier used an attacker-controlled algorithm value from an unverified token, which could lead to algorithm confusion after an asymmetric-signing migration. This issue is fixed in version 1.9.2, which introduces a server-controlled algorithm allowlist. The fix helps prevent potential algorithm confusion attacks by ensuri [truncated]
A vulnerability in Lemur's user password management allowed plaintext passwords to be stored in the database when administrators changed passwords via the API. This issue was fixed in version 1.9.2 by adding a before_update event listener to hash the new password. The vulnerability exposed immediately usable credentials without offline cracking in the event of a database, backup, replica, query-log, or ad [truncated]
A vulnerability in Lemur's role management functionality allowed unauthorized role updates, potentially leading to lateral privilege escalation within roles controlling certificate and authority access. The issue requires verification of role update permissions and access logs. This vulnerability was fixed in version 1.9.2 of Lemur. The CVE record and NVD entry provide details on the vulnerability, its im [truncated]
An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. This vulnerability allows an authenticated operator to potentially probe or affect inte [truncated]