In Netflix Lemur versions before 1.9.3, the CertificateExport handler placed its CertificatePermission ownership check inside a conditional branch that only applied if a plugin required a private key. Plugins declaring requires_key as false bypassed this ownership check, yet the handler still passed the private key to the plugin and logged a key_view audit event. The bundled JavaTruststoreExportPlugin ignored the private key, limiting immediate exposure to public certificate data and misleading audit entries. However, a future plugin could have consumed the private key, leading to unauthorized access. The fix in version 1.9.3 ensures no private key is passed to plugins that do not require one and confines ownership checks and key_view logging to actual private-key exports.

The vulnerability allows plugins that do not require private keys to bypass ownership authorization checks and receive private key data, potentially leading to unauthorized access to private keys if a malicious or vulnerable plugin consumes this data. Immediate exposure was limited to public certificate material and misleading audit logs, but the flaw could be exploited by future plugins to access sensitive private key information.

Upgrade to Lemur version 1.9.3 or later, where this issue is fixed. The fix prevents private key data from being passed to plugins that do not require it and enforces ownership checks and audit logging only for actual private key exports.