CVE-2026-71322
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Impact
Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false bypassed that check, and the handler still passed cert.private_key as an argument and recorded a key_view audit event. The bundled JavaTruststoreExportPlugin ignored the key, so the immediate exposure was limited to public certificate material and misleading audit entries, but a future plugin could have consumed the supplied key. The fix passes no private key to plugins that do not require one and confines ownership checks and key_view logging to actual private-key exports. This issue is fixed in version 1.9.3.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | lemur | < 1.9.3 | 1.9.3 |