DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-71303: CVE-2026-71303: Server-Side Request Forgery Bypass in Netflix Lemur Authority Updates

#security #cve #cybersecurity

CVE-2026-71303: Server-Side Request Forgery Bypass in Netflix Lemur Authority Updates

Vulnerability ID: CVE-2026-71303
CVSS Score: 7.7
Published: 2026-08-18

Netflix Lemur, an open-source TLS certificate management framework, is affected by a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability arises from an incomplete patch for a previous security flaw, CVE-2026-55166. While Lemur version 1.9.2 validated the ACME directory URL against an allowlist during authority creation, it failed to perform the same checks when updating existing authorities. An authenticated user possessing an authority role can exploit this omission to replace the directory URL with internal or cloud metadata endpoints. During subsequent certificate issuance, the Lemur backend executes unauthorized requests, potentially leaking sensitive metadata or credentials.

TL;DR

An incomplete patch in Netflix Lemur allows users with authority roles to bypass host allowlists. By submitting a crafted PUT request, attackers can overwrite the ACME directory URL with internal IP addresses, causing the Lemur backend to perform unauthorized outbound connections.

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network
  • CVSS Severity: 7.7 High
  • EPSS Score: Not Calculated
  • Impact: Server-Side Request Forgery leading to unauthorized internal access or credential leakage
  • Exploit Status: No public weaponized exploits available
  • KEV Status: Not listed in CISA KEV Catalog

Affected Systems

  • Netflix Lemur certificate management environments deployed prior to version 1.9.3
  • Lemur: < 1.9.3 (Fixed in: 1.9.3)

Code Analysis

Commit: edca039

Fix validation bypass by ensuring acme_url is validated during authority update operations

--- a/lemur/authorities/service.py\n+++ b/lemur/authorities/service.py\n@@ -118,5 +118,10 @@ def update(authority_id, description, owner, active, roles, options: Optional[str] = None):\n     if options:\n+        from lemur.plugins.lemur_acme.plugin import validate_acme_url\n+\n+        for option in json.loads(options):\n+            if option.get(\"name\") == \"acme_url\":\n+                validate_acme_url(option.get(\"value\", \"\"))\n         authority.options = options
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade Netflix Lemur to version 1.9.3 or newer to ensure all authority modifications are validated
  • Implement host-level iptables or routing rules to block outgoing traffic to 169.254.169.254 from the Lemur application process
  • Enforce AWS IMDSv2 with a hop limit of 1 to prevent metadata access from application runtimes
  • Restrict outbound API network access to known, trusted external ACME directory domains via firewalls or security groups

Remediation Steps:

  1. Locate the current Lemur installation path and verify the active version
  2. Retrieve the updated code from the official repository or package manager for version 1.9.3
  3. Apply database migrations and restart the Lemur application services
  4. Review user role permissions to ensure only administrative accounts can modify ACME authorities

References

Read the full report for CVE-2026-71303 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)