CVE-2026-55166
Received Received - Intake

Lemur ACME Authority SSRF and Authorization Weakness

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destination restriction and trigger AcmeHandler.setup_acme_client to make backend requests. An attacker could target cloud instance metadata or internal services from Lemur network context, potentially obtaining credentials available to the host. The advisory also identifies creator-equality authorization behavior that could preserve access to certificate key material after ownership or role changes, with insufficient export_private_key audit context to distinguish that access path. Together, the acme_url server-side request forgery and authorization weakness could expose cloud credentials and long-lived PKI private-key access. The fix adds ACME_DIRECTORY_HOST_ALLOWLIST validation and enriches key-export audit events with creator and current-owner context. This issue is fixed in version 1.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-55166
EUVD
EUVD-2026-61148

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lemur lemur 1.9.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55166 is a critical vulnerability in Lemur, a TLS certificate management tool. It allows authenticated users to exploit server-side request forgery (SSRF) via an unrestricted ACME acme_url parameter to access cloud instance metadata or internal services. Additionally, an authorization weakness enables users to retain access to private keys even after ownership changes, bypassing audit trails.

Detection Guidance

Monitor for unauthorized ACME authority creation attempts or unusual outbound requests to cloud metadata endpoints like AWS IMDS (169.254.169.254). Check logs for private key export events with creator_id and current_owner fields to detect creator-equality access patterns. Inspect network traffic for SSRF attempts targeting internal or private IP ranges.

Impact Analysis

An attacker could compromise cloud credentials like AWS IAM, issue fraudulent certificates, and gain permanent access to private keys. This enables decryption of stored data, lateral movement in cloud environments, and impersonation of TLS endpoints, posing severe risks to data confidentiality and integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, reputational damage, and loss of trust due to exposure of personal or health information.

Mitigation Strategies

Upgrade Lemur to version 1.9.2 or later. Configure ACME_DIRECTORY_HOST_ALLOWLIST to restrict ACME directory URLs to trusted providers like Let's Encrypt. Implement network-level controls to block outbound requests to cloud metadata endpoints and private IP ranges. Review and revoke any certificates issued via unauthorized ACME authorities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55166. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart