Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

SummaryThe ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

SummaryThe fix for GHSA-v2wp-frmc-5q3v added validateacmeurl to reject acmeurl values not in ACMEDIRECTORYHOSTALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- including a...

PYSEC-2026-3680 Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Summary The ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

PT-2026-80652

Summary The fix for GHSA-v2wp-frmc-5q3v added validate acme url to reject acme url values not in ACME DIRECTORY HOST ALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- includin...

PT-2026-80653

Summary The ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acme url, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it

Summary Repo under test: https://github.com/Netflix/lemur PUT /api/1/certificates//revoke authorizes the caller against the Lemur database row creator == current user, or CertificatePermission over the row's roles rather than the underlying CA-side certificate identity. Separately, POST...

GHSA-V5RC-CPWC-CFPR Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Summary The fix for GHSA-v2wp-frmc-5q3v added validateacmeurl to reject acmeurl values not in ACMEDIRECTORYHOSTALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- including a...

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Summary The fix for GHSA-v2wp-frmc-5q3v added validateacmeurl to reject acmeurl values not in ACMEDIRECTORYHOSTALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- including a...

Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Summary The ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

Server-side Request Forgery (SSRF)

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ACME client following server-controlled URLs in acmehandlers.py. A malicious or compromised ACME server can embed arbitrary internal UR...

GHSA-XPMJ-WJCP-6PWW Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Summary The ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

CVE-2026-70666

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...

CVE-2026-71303

Lemur manages TLS certificate creation. Prior to 1.9.3, validateacmeurl enforced ACMEDIRECTORYHOSTALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the...

CVE-2026-55166

Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acmeurl without an effective server-side destination restriction and trigger AcmeHandler.setupacmeclient to make backend requests. An attacker could target cloud instance metadata or...

CVE-2026-70666 Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...

CVE-2026-70666 Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...

CVE-2026-70666

CVE-2026-70666 is a Server-Side Request Forgery (SSRF) in Lemur (Netflix's TLS certificate manager), rated CVSS 7.4 HIGH . Two defects combine: the acme_url allowlist is validated only at authority creation, not on the PUT /api/1/authorities/ update path, and the ACME client follows server-suppli...

EUVD-2026-61155

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...

CVE-2026-70666 Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...

CVE-2026-71303 Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Lemur manages TLS certificate creation. Prior to 1.9.3, validateacmeurl enforced ACMEDIRECTORYHOSTALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the...