EUVD-2026-61154
GHSA-v5rc-cpwc-cfpr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Authority-role requirement sets PR:L; SSRF crosses system boundary to IMDS (S:C); only confidentiality exposed via metadata read with no write or availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4Blast Radius
ecosystem impact- 3 pypi packages depend on lemur (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.9.3.
DescriptionCVE.org
Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the stored acme_url with an internal service or instance-metadata URL such as 169.254.169.254. The next issuance operation loaded that value and passed it to ClientV2.get_directory, causing an outbound request from the Lemur backend. This bypassed the creation-time mitigation for CVE-2026-55166 and could expose internal services or cloud metadata. The fix revalidates acme_url whenever authority options are updated. This issue is fixed in version 1.9.3.
AnalysisAI
Server-side request forgery in Netflix Lemur's authority update path allows an authenticated user holding an authority role to redirect the Lemur backend into fetching arbitrary internal URLs, including cloud instance metadata endpoints such as 169.254.169.254. This is an incomplete-fix bypass of CVE-2026-55166 (GHSA-v2wp-frmc-5q3v): the creation-time allowlist check in _validate_acme_url was never applied to the PUT /api/1/authorities/ update path, leaving the stored acme_url writable without re-validation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Lemur user who holds a role on an existing ACME-type authority (the PR:L privilege). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects the genuine scope change: the SSRF crosses the Lemur trust boundary and reaches cloud metadata or internal services, enabling credential theft from IMDS in AWS, GCP, or Azure deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Lemur to version 1.9.3, which applies `validate_acme_url` allowlist enforcement inside `lemur/authorities/service.py::update()` for every authority options update. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether Netflix Lemur is deployed in your environment and document current versions across all infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today