{"vulnerability": "CVE-2026-71308", "sightings": [{"uuid": "a857993b-8465-4020-aabe-4456d74b14e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71308", "type": "published-proof-of-concept", "source": "https://github.com/Netflix/lemur/security/advisories/GHSA-cfh6-pv5c-38jv", "content": "", "creation_timestamp": "2026-08-18T22:35:09.557316Z"}, {"uuid": "91804b48-2a50-46af-9179-4706e54a7729", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71308", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mtfky2ijcb2v", "content": "CVE-2026-71308 affects Lemur\u2019s certificate create and upload endpoints: unchecked replaces[] references can disable notifications and auto-reissue for certificates the caller does not own. #software", "creation_timestamp": "2026-08-19T01:22:20.664809Z"}, {"uuid": "b9f8509a-a65a-4d38-804e-04c64d600e90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71308", "type": "seen", "source": "https://gist.github.com/alon710/efd05c94aa8a7f9db39650de6553e415", "content": "# CVE-2026-71308: CVE-2026-71308: Missing Authorization and Lifecycle Hijacking in Netflix Lemur\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71308\n\n## Summary\nNetflix Lemur before 1.9.3 contains a missing authorization vulnerability (CWE-862, CWE-639) when handling certificate creation, upload, or modification. Authenticated non-read-only users can manipulate the replaces parameter to silence expiration notifications and hijack certificate rotation tasks for arbitrary targets, leading to unauthorized TLS certificate deployment and traffic interception.\n\n## TL;DR\nMissing authorization in Netflix Lemur's certificate replacement logic allows standard users to hijack TLS certificate rotation and silence expiration alerts.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 / CWE-639\n- **Attack Vector**: Network (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)\n- **CVSS Score**: 8.1 (High)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Netflix Lemur\n- **Lemur**: >= 0.5.0, < 1.9.3 (Fixed in: `1.9.3`)\n\n## Mitigation\n\n- Upgrade Netflix Lemur to version 1.9.3 or higher\n- Restrict standard user access to certificate write and edit endpoints\n- Regularly audit active certificate replaces relationships in the Lemur database\n\n**Remediation Steps:**\n1. Identify and catalog all active Netflix Lemur deployments\n2. Apply the security update to upgrade Lemur to version 1.9.3\n3. Verify that current user accounts follow the principle of least privilege\n4. Execute database queries to audit historical replacements for unauthorized mapping configurations\n\n## References\n\n- [Netflix Lemur Authorization Fix Commit](https://github.com/Netflix/lemur/commit/286874535160952143b0afe2d356642669f9d4c6)\n- [Netflix Lemur Release Tag v1.9.3](https://github.com/Netflix/lemur/releases/tag/v1.9.3)\n- [GitHub Security Advisory GHSA-cfh6-pv5c-38jv](https://github.com/Netflix/lemur/security/advisories/GHSA-cfh6-pv5c-38jv)\n- [NVD CVE-2026-71308 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-71308)\n- [CVE Program CVE-2026-71308 Record](https://www.cve.org/CVERecord?id=CVE-2026-71308)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71308) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T06:44:38.271493Z"}]}