EUVD-2026-61155
GHSA-xpmj-wjcp-6pww
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Network-reachable by authenticated authority-role user (PR:L); scope changes to internal systems via SSRF; availability omitted as SSRF does not directly cause service outage.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4Blast Radius
ecosystem impact- 3 pypi packages depend on lemur (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.9.3.
DescriptionCVE.org
Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and direct setup_acme_client_no_retry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder, authorizations, and finalize URLs chosen by that server. The Lemur ClientV2 followed those URLs without requiring their host to match the configured directory host, allowing JWS-signed requests to internal services or cloud metadata endpoints. The issue required an ACME authority and a user authorized for that authority, but did not require global administrator privileges. The fix revalidates updates and introduces _PinnedClientNetwork to enforce a single allowed host for the complete ACME flow. This issue is fixed in version 1.9.3.
AnalysisAI
Server-side request forgery in Netflix Lemur prior to 1.9.3 allows authority-role users to redirect ACME certificate issuance workflows to attacker-controlled servers, enabling JWS-signed HTTP requests to reach internal services or cloud metadata endpoints. The flaw exists in two components acting together: the PUT /api/1/authorities/ endpoint accepted acme_url modifications without revalidating the host against an allowlist, and the ACME ClientV2 blindly followed server-supplied URLs for nonce, order, authorization, and finalize operations without confirming the hostname matched the configured directory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active Lemur user account with authority-role membership on at least one ACME-type certificate authority configured in the instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.4 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L accurately reflects the threat model: network-reachable, low complexity, requiring only low-privileged authentication, with a scope change that extends impact to internal systems beyond the Lemur process itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Netflix Lemur to version 1.9.3, available at https://github.com/Netflix/lemur/releases/tag/v1.9.3 and detailed in the advisory at https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, perform a complete inventory of Lemur deployments to identify all systems running versions prior to 1.9.3 and immediately restrict access to ACME configuration settings for privileged users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today