# lemur (PyPI) vulnerabilities

18 known vulnerabilities (1 critical, 8 high, 8 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 94
- Dependents: 3
- Registry: https://pypi.org/project/lemur/

## Advisories (18)

### [CVE-2026-71417](https://cve.now/CVE-2026-71417): Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

- Severity: High 7.3
- Published: Aug 18, 2026
- Affected: fixed in 1.9.3.

### [CVE-2026-71322](https://cve.now/CVE-2026-71322): Lemur: Missing authorization check on POST /certificates/\<id\>/export for plugins with requires\_key = False

- Severity: Medium 4.3
- Published: Aug 18, 2026
- Affected: fixed in 1.9.3.

### [CVE-2026-71317](https://cve.now/CVE-2026-71317): Lemur: Sub-CA creation never checks \`AuthorityPermission\` on the parent authority

- Severity: Medium 6.5
- Published: Aug 18, 2026
- Affected: fixed in 1.9.3.

### [CVE-2026-70666](https://cve.now/CVE-2026-70666): Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

- Severity: High 7.4
- Published: Aug 18, 2026
- Affected: fixed in 1.9.3.

### [CVE-2026-71303](https://cve.now/CVE-2026-71303): Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace \`acme\_url\` with internal IP…

- Severity: High 7.7
- Published: Aug 18, 2026
- Affected: fixed in 1.9.3.

### [CVE-2026-71307](https://cve.now/CVE-2026-71307): Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the…

- Severity: High 7.7
- Published: Aug 18, 2026
- Affected: fixed in 1.9.3.

### [CVE-2026-71308](https://cve.now/CVE-2026-71308): Lemur: Unchecked \`replaces\[\]\` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

- Severity: High 8.1
- Published: Aug 18, 2026
- Affected: from 0.5.0, fixed in 1.9.3.

### [CVE-2026-70667](https://cve.now/CVE-2026-70667): Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for…

- Severity: Medium 6.3
- Published: Aug 18, 2026
- Affected: fixed in 1.9.3.

### [CVE-2026-55164](https://cve.now/CVE-2026-55164): Lemur: Plaintext password storage in Lemur user-update path

- Severity: Medium 4.9
- Published: Aug 18, 2026
- Affected: fixed in 1.9.2.

### [CVE-2026-55162](https://cve.now/CVE-2026-55162): Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates

- Severity: Medium 6.3
- Published: Aug 18, 2026
- Affected: fixed in 1.9.2.

### [CVE-2026-55166](https://cve.now/CVE-2026-55166): Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme\_url SSRF and creator-equality IDOR

- Severity: Critical 9.9
- Published: Aug 18, 2026
- Affected: fixed in 1.9.2.

### [CVE-2026-55163](https://cve.now/CVE-2026-55163): Lemur: Privilege escalation via PUT /api/1/roles/\<id\> — non-admin role members can rewrite role membership

- Severity: Medium 6.3
- Published: Aug 18, 2026
- Affected: fixed in 1.9.2.

### [CVE-2026-55165](https://cve.now/CVE-2026-55165): Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure

- Severity: Medium 4.8
- Published: Aug 18, 2026
- Affected: fixed in 1.9.2.

### [CVE-2026-48508](https://cve.now/CVE-2026-48508): Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission

- Severity: High 8.8
- Published: Aug 18, 2026
- Affected: fixed in 1.9.1.

### [CVE-2026-44305](https://cve.now/CVE-2026-44305): Lemur: LDAP TLS certificate verification globally disabled enables credential interception

- Severity: Medium 6.8
- Published: May 12, 2026
- Affected: fixed in 1.9.0.

### [CVE-2026-44304](https://cve.now/CVE-2026-44304): Lemur: LDAP Filter Injection enables post-authentication privilege escalation

- Severity: High 8.1
- Published: May 12, 2026
- Affected: fixed in 1.9.0.

### [CVE-2023-30797](https://cve.now/CVE-2023-30797): Insecure Random Generation in Netflix Lemur

- Severity: High 7.5
- Published: Apr 19, 2023
- Affected: fixed in 1.3.2; fixed in 1.3.2.

### [CVE-2015-7764](https://cve.now/CVE-2015-7764): Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.

- Severity: Unrated
- Published: Aug 9, 2017
- Affected: fixed in 0.2.1; fixed in 0.1.5.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/lemur
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.