DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-70667: CVE-2026-70667: Server-Side Request Forgery Bypass in Netflix Lemur Certificate Verification

#security #cve #cybersecurity

CVE-2026-70667: Server-Side Request Forgery Bypass in Netflix Lemur Certificate Verification

Vulnerability ID: CVE-2026-70667
CVSS Score: 6.3
Published: 2026-08-18

A security vulnerability in Netflix Lemur, a TLS certificate management framework, allows authenticated operators to bypass Server-Side Request Forgery (SSRF) mitigations. The issue exists within the certificate revocation verification workflow, specifically inside the CRL and OCSP retrieval logic. By exploiting HTTP redirects or DNS rebinding (Time-of-Check Time-of-Use) mechanisms, an attacker can coerce the server into issuing arbitrary network requests to internal services, such as the cloud instance metadata service (IMDS) or loopback addresses. This bypass neutralizes previous network-boundary validation logic and allows blind read/write SSRF targeting internal infrastructure resources.

TL;DR

A flaw in Netflix Lemur prior to v1.9.3 allows authenticated operators to bypass Server-Side Request Forgery (SSRF) protections. This is accomplished using DNS rebinding and HTTP redirects during certificate revocation checking (CRL/OCSP), exposing private VPC infrastructure and AWS instance metadata (IMDS).

Technical Details

  • CWE ID: CWE-918, CWE-367
  • Attack Vector: Network
  • CVSS Score: 6.3
  • EPSS Percentile: N/A
  • Impact: Server-Side Request Forgery (SSRF) bypass to internal targets
  • Exploit Status: Conceptual
  • KEV Status: Not Listed

Affected Systems

  • Netflix Lemur
  • Lemur: < 1.9.3 (Fixed in: 1.9.3)

Code Analysis

Commit: ed504a8

Fix SSRF/TOCTOU in CRL and OCSP verification by disabling redirects and pinning connection IPs

Mitigation Strategies

  • Upgrade Lemur to version 1.9.3 or later to enforce resolution pinning and disable redirect-following during certificate validation.
  • Implement egress firewall controls to block Lemur from making outbound calls to internal IP addresses (RFC1918) and link-local targets (169.254.169.254).
  • Restrict the certificate upload endpoint (POST /api/1/certificates/upload) to highly privileged roles.
  • Enforce AWS IMDSv2 with a hop limit of 1 to protect local metadata.

Remediation Steps:

  1. Audit the currently deployed version of Netflix Lemur to verify if it is below 1.9.3.
  2. Pull the latest stable release of Lemur (v1.9.3) or apply commit ed504a830f38a83825b1570302e9f38d6553938a to the local codebase.
  3. Rebuild and deploy the updated Lemur container image or application package.
  4. Validate the patch by attempting to upload a test certificate containing a redirection URL pointing to a private resource. Verify that the request is rejected or fails safely.
  5. Deploy host-level firewall rules (such as iptables rules) to explicitly block outbound connections from the lemur execution user to the local metadata endpoint.

References

Read the full report for CVE-2026-70667 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)