THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-cfh6-pv5c-38jv (high) — Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

[GHSA] GHSA-cfh6-pv5c-38jv (high) — Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

medgithub_advisoriesPublished 2026-08-18

GHSA-cfh6-pv5c-38jv Severity: high CVE: CVE-2026-71308

Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

## Summary

Repo under test: https://github.com/Netflix/lemur

The certificate create and upload endpoints accept a `replaces[]` (alias `replacements`) array that is resolved to live `Certificate` ORM objects with no ownershi

Indicators of compromise

CVE-2026-71308cve

Original source: https://github.com/advisories/GHSA-cfh6-pv5c-38jv