CVE-2026-71317: Lemur Sub-CA Creation Never Checks `AuthorityPermission` Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-g7p5-89mh-248h",
  "modified" : "2026-08-18T20:51:38Z",
  "published" : "2026-08-18T20:51:37Z",
  "aliases" : [ "CVE-2026-71317" ],
  "summary" : "Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority",
  "details" : "## Summary\n\nRepo under test: https://github.com/Netflix/lemur\n\nWhen `ADMIN_ONLY_AUTHORITY_CREATION=False` (an explicitly supported and documented configuration), `POST /api/1/authorities` with `type=subca` never verifies that the caller holds `AuthorityPermission` on the supplied `parent` authority. The `parent` field is resolved by `AssociatedAuthoritySchema` via a raw `fetch_objects(Authority, data)` lookup, then passed straight through `service.create → mint → cryptography-issuer.create_authority`, which loads `options[\"parent\"].authority_certificate.private_key` and signs a brand-new intermediate CA on the caller's behalf.\n\nAny authenticated non-read-only user can therefore mint a sub-CA chained to any internal root whose private key Lemur holds — including roots they hold no role on — attach a role they already belong to, and immediately issue or offline-sign trusted leaf certificates for arbitrary names.\n\n## Affected route\n\n`POST /api/1/authorities` (with `type=subca`)\n\n## Affected code\n\n- [`lemur/authorities/views.py:231`](https://github.com/Netflix/lemur/blob/main/lemur/authorities/views.py#L231) — gates only on `AuthorityCreatorPermission()` + `StrictRolePermission()`; no `AuthorityPermission` on `data['parent']`\n- [`lemur/authorities/schemas.py:58`](https://github.com/Netflix/lemur/blob/main/lemur/authorities/schemas.py#L58) — `parent = fields.Nested(AssociatedAuthoritySchema)`; `validate_subca` only checks presence\n- [`lemur/schemas.py:107`](https://github.com/Netflix/lemur/blob/main/lemur/schemas.py#L107) — `AssociatedAuthoritySchema.get_object` → `fetch_objects(Authority, data)` resolves any authority by id/name with no permission check\n- [`lemur/plugins/lemur_cryptography/plugin.py:40`](https://github.com/Netflix/lemur/blob/main/lemur/plugins/lemur_cryptography/plugin.py#L40) — `private_key = options[\"authority\"].authority_certificate.private_key` (set from `options[\"parent\"]`) signs the new intermediate\n- [`lemur/auth/permissions.py:62`](https://github.com/Netflix/lemur/blob/main/lemur/auth/permissions.py#L62) — `AuthorityCreatorPermission` becomes always-allow when `ADMIN_ONLY_AUTHORITY_CREATION=False`\n- [`lemur/certificates/views.py:538`](https://github.com/Netflix/lemur/blob/main/lemur/certificates/views.py#L538) — `is_private_authority` (true for `cryptography-issuer`) skips `USER_DOMAIN_AUTHORIZATION_PROVIDER` for subsequent leaf issuance\n\n## Impact\n\nIn deployments that set `ADMIN_ONLY_AUTHORITY_CREATION=False` to enable self-service CA creation, any authenticated non-read-only user — with zero permission on a given internal root CA — can obtain a working intermediate CA chained to that root. They can then:\n\n- Issue TLS certificates for arbitrary names trusted by every relying party that trusts the internal root, bypassing `LEMUR_ALLOWED_DOMAINS`, sensitive-domain flags, and the per-user domain-authorization plugin.\n- Export the sub-CA private key and sign end-entity certificates entirely outside Lemur, defeating all in-product issuance controls.\n\nThis converts \"can create a self-contained test CA\" into \"can mint trusted certs under any internal PKI root in the organisation\". The `ADMIN_ONLY_AUTHORITY_CREATION` documentation does not warn operators of this consequence.\n\n## Root cause\n\n`AuthoritiesList.post` evaluates `AuthorityCreatorPermission` (a global \"may create authorities\" flag) and `StrictRolePermission`, but never evaluates `AuthorityPermission(parent.id, parent.roles)` against the caller-supplied `parent`. `AssociatedAuthoritySchema` is a pure lookup schema with no authz hook, and neither `authorities.service.create` nor `mint` re-check before invoking `issuer_plugin.create_authority(options)`. The bundled `cryptography-issuer` then uses the parent's stored private key directly.\n\n## Validated evidence\n\nStatic trace, confirmed by code inspection (validation status: `CONFIRMED`):\n\n- `parent` is loaded via `AssociatedAuthoritySchema` (raw `fetch_objects`), passed unchecked through `views.post → service.create → mint → plugin.create_authority → issue_certificate`, where the parent authority's stored private key is read and used to sign the new intermediate.\n- No call to `AuthorityPermission(parent.id, ...)` exists anywhere on this path.\n- Precondition `ADMIN_ONLY_AUTHORITY_CREATION=False` is an explicitly supported config ([`docs/administration.rst:517`](https://github.com/Netflix/lemur/blob/main/docs/administration.rst#L517)).\n\n## Proof of concept / reproducer\n\nStatus: reconstructed from source report (static control-flow trace; not executed against a live CA).\n\nPreconditions: `ADMIN_ONLY_AUTHORITY_CREATION=False`; attacker is an authenticated Lemur user holding any role other than `read-only`; `<PARENT_AUTHORITY_ID>` is any internal `cryptography-issuer` root CA the attacker holds no role on; `<ATTACKER_ROLE>` is any role the attacker already belongs to.\n\n```bash\ncurl -sS -X POST \"<TARGET_BASE_URL>/api/1/authorities\" \\\n  -H \"Authorization: Bearer <AUTH_TOKEN>\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n        \"name\": \"attacker-subca\",\n        \"owner\": \"attacker@example.com\",\n        \"description\": \"poc\",\n        \"type\": \"subca\",\n        \"parent\": {\"id\": <PARENT_AUTHORITY_ID>},\n        \"plugin\": {\"slug\": \"cryptography-issuer\"},\n        \"roles\": [{\"name\": \"<ATTACKER_ROLE>\"}],\n        \"commonName\": \"attacker-intermediate\",\n        \"validityYears\": 1\n      }'\n```\n\nThe response contains a new authority whose `authority_certificate` is signed by `<PARENT_AUTHORITY_ID>`'s private key. The caller is recorded as creator and holds `<ATTACKER_ROLE>` on it, so `POST /api/1/certificates` against the new authority succeeds (and skips `allowed_issuance_for_domain` because `is_private_authority` is true).\n\nStatic-trace validation command from the source report:\n\n```bash\ngrep -n 'parent' lemur/authorities/schemas.py lemur/authorities/views.py lemur/authorities/service.py \\\n  && sed -n '37,55p' lemur/plugins/lemur_cryptography/plugin.py\n```\n\nSource artifact: `audit/harnesses/public-repo-threat-model-harness/results/netflix-lemur-100run-mythos-20260627T051129Z/findings.jsonl` (run_022, finding cluster `lemur-subca-parent-authz`, 5/100 runs).\n\n## Suggested fix\n\nIn `AuthoritiesList.post` (or `authorities.service.create`), when `data.get('parent')` is present, enforce `AuthorityPermission(parent.id, [r.name for r in parent.roles]).can()` before invoking the issuer plugin, regardless of `ADMIN_ONLY_AUTHORITY_CREATION`. Additionally, update the `ADMIN_ONLY_AUTHORITY_CREATION` documentation to state that disabling it currently grants every authenticated user the ability to chain sub-CAs off any internal root whose private key Lemur holds. Consider also requiring admin (or an explicit per-parent capability) for any `type=subca` creation independent of the global flag.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "lemur"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.9.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.9.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Netflix/lemur/security/advisories/GHSA-g7p5-89mh-248h"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Netflix/lemur/commit/8669011203ca3dd89d9e39bab9ef6850eca723f9"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Netflix/lemur"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Netflix/lemur/releases/tag/v1.9.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-18T20:51:37Z",
    "nvd_published_at" : null
  }
}