- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 18 · 1 critical, 8 high, 8 medium
- Weekly downloads
- 94
- Dependents
- 3
- Registry
- PyPI
Advisories 18
- CVE-2026-71417High 7.3
Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
Affected: fixed in 1.9.3.
- CVE-2026-71322Medium 4.3
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Affected: fixed in 1.9.3.
- CVE-2026-71317Medium 6.5
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
Affected: fixed in 1.9.3.
- CVE-2026-70666High 7.4
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
Affected: fixed in 1.9.3.
- CVE-2026-71303High 7.7
Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP…
Affected: fixed in 1.9.3.
- CVE-2026-71307High 7.7
Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the…
Affected: fixed in 1.9.3.
- CVE-2026-71308High 8.1
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
Affected: from 0.5.0, fixed in 1.9.3.
- CVE-2026-70667Medium 6.3
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for…
Affected: fixed in 1.9.3.
- CVE-2026-55164Medium 4.9
Lemur: Plaintext password storage in Lemur user-update path
Affected: fixed in 1.9.2.
- CVE-2026-55162Medium 6.3
Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates
Affected: fixed in 1.9.2.
- CVE-2026-55166Critical 9.9
Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR
Affected: fixed in 1.9.2.
- CVE-2026-55163Medium 6.3
Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership
Affected: fixed in 1.9.2.
- CVE-2026-55165Medium 4.8
Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure
Affected: fixed in 1.9.2.
- CVE-2026-48508High 8.8
Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission
Affected: fixed in 1.9.1.
- CVE-2026-44305Medium 6.8
Lemur: LDAP TLS certificate verification globally disabled enables credential interception
Affected: fixed in 1.9.0.
Show all 18 advisoriesShow fewer advisories
- CVE-2026-44304High 8.1
Lemur: LDAP Filter Injection enables post-authentication privilege escalation
Affected: fixed in 1.9.0.
- CVE-2023-30797High 7.5
Insecure Random Generation in Netflix Lemur
Affected: fixed in 1.3.2; fixed in 1.3.2.
- CVE-2015-7764Unrated
Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.
Affected: fixed in 0.2.1; fixed in 0.1.5.