DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-70666: CVE-2026-70666: Server-Side Request Forgery in Netflix Lemur ACME Authority Management

#security #cve #cybersecurity

CVE-2026-70666: Server-Side Request Forgery in Netflix Lemur ACME Authority Management

Vulnerability ID: CVE-2026-70666
CVSS Score: 7.4
Published: 2026-08-18

CVE-2026-70666 is a critical Server-Side Request Forgery (SSRF) vulnerability in Netflix Lemur's ACME certificate management integration. Prior to version 1.9.3, the system allowed authority-role users to bypass initial ACME URL allowlist validations when updating an existing authority. Additionally, the underlying ACME network client blindly parsed and connected to dynamic endpoint URLs supplied in JSON responses from the configured ACME directory, allowing attackers to route arbitrary JWS-signed requests to internal services or cloud metadata endpoints.

TL;DR

An SSRF vulnerability in Netflix Lemur allows lower-privileged users with authority roles to update authority settings to point to a rogue ACME server. The Lemur ACME client then trusts server-supplied dynamic URLs, enabling attackers to query private internal endpoints and retrieve cloud instance credentials.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.4
  • Privileges Required: Low (Tenant Authority Role)
  • Impact: Server-Side Request Forgery & Information Disclosure
  • Exploit Status: Proof of Concept available
  • KEV Status: Not Listed

Affected Systems

  • Netflix Lemur
  • Lemur: < 1.9.3 (Fixed in: 1.9.3)

Code Analysis

Commit: 6dcb19b

Fix: Enforce ACME directory URL allowlist during authority updates and introduce PinnedClientNetwork to prevent SSRF via server-supplied directory URLs.

Exploit Details

  • GitHub Security Advisory: Vulnerability details, reproduction vectors, and remediation patches detailed inside the official security advisory repository.

Mitigation Strategies

  • Upgrade Netflix Lemur to version 1.9.3 or higher
  • Implement strict egress network controls on Lemur application hosts
  • Enable IMDSv2 with a hop limit of 1 on AWS deployments to prevent metadata access
  • Enforce network isolation for the Lemur instance

Remediation Steps:

  1. Identify active ACME authorities configured in the Lemur system.
  2. Analyze database options for unauthorized domains in the 'acme_url' configuration.
  3. Apply the Lemur update to version 1.9.3.
  4. Verify that the update is successful by testing authority options modification constraints.

References

Read the full report for CVE-2026-70666 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)