EUVD-2026-61151
GHSA-f3qq-49m6-rw8f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Scope changes to C because SSRF crosses into internal network and cloud metadata; no availability impact from blind requests; PR:L confirmed by operator-only upload endpoint.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3Blast Radius
ecosystem impact- 3 pypi packages depend on lemur (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.9.3.
DescriptionCVE.org
Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, so a public attacker-controlled URL could redirect to loopback, RFC1918, link-local, or instance-metadata addresses. Validation and connection also performed separate DNS resolutions, creating a time-of-check time-of-use window for DNS rebinding on both CRL and OCSP paths. An operator uploading a certificate through POST /api/1/certificates/upload could therefore induce blind internal requests despite the earlier mitigation. The fix disables redirects and pins validated addresses while preserving the correct Host value. This issue is fixed in version 1.9.3.
AnalysisAI
Blind SSRF in Netflix Lemur's certificate revocation URL validation allows authenticated operators to induce internal network requests targeting loopback, RFC1918, link-local, or cloud instance-metadata addresses. Two distinct bypass paths exist in versions prior to 1.9.3: the _validate_revocation_url function in verify.py followed HTTP redirects without validating Location targets, allowing a whitelisted CRL or OCSP URL to silently redirect the actual fetch to an internal address; and separate DNS resolutions at validation and connection time created a TOCTOU window exploitable via DNS rebinding on both CRL and OCSP code paths. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated operator account with permission to call POST /api/1/certificates/upload - confirmed by CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects network accessibility with low-privilege requirements and moderate impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Lemur version 1.9.3 or later, which is the vendor-confirmed patched release (https://github.com/Netflix/lemur/releases/tag/v1.9.3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today