CVE-2026-55162
Received Received - Intake

Lemur Certificate Verification CRL/OCSP URL Spoofing

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-55162
EUVD
EUVD-2026-61149

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lemur lemur 1.9.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55162 is a post-authentication Server-Side Request Forgery (SSRF) vulnerability in Lemur, a TLS certificate management tool. When verifying uploaded certificates, Lemur extracts and follows CRL Distribution Point and OCSP responder URLs from certificate extensions without proper validation. An authenticated operator can craft malicious certificates with URLs pointing to internal services, causing Lemur to make outbound requests to those destinations during verification.

Detection Guidance

Monitor outbound network requests from the Lemur host during certificate verification, particularly to loopback, RFC1918, link-local, or instance-metadata destinations like 169.254.169.254. Check for unusual CRL or OCSP URL extractions from uploaded certificates using logs or packet captures.

Impact Analysis

An attacker could probe internal network services, infer network topology, or interact with sensitive endpoints like EC2's IMDSv1. The unbounded CRL cache could also be exploited for memory exhaustion attacks. While exploitation requires operator privileges, it enables network reconnaissance and potential side effects from the Lemur host's network position.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially violating data protection requirements under GDPR or HIPAA. Uncontrolled network probing and interaction with sensitive services may result in data breaches or unauthorized disclosure of protected information, posing compliance risks.

Mitigation Strategies

Upgrade Lemur to version 1.9.2 or later. Configure allowlists for CRL/OCSP hostnames using LEMUR_TRUSTED_CRL_HOSTS and LEMUR_TRUSTED_OCSP_HOSTS. Implement SSRF-safe HTTP clients to block sensitive destinations. Review and rehash plaintext passwords if stored.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55162. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart