CVE-2026-70666

Received Received - Intake

Lemur ACME Client Misconfiguration Leading to SSRF

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and direct setup_acme_client_no_retry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder, authorizations, and finalize URLs chosen by that server. The Lemur ClientV2 followed those URLs without requiring their host to match the configured directory host, allowing JWS-signed requests to internal services or cloud metadata endpoints. The issue required an ACME authority and a user authorized for that authority, but did not require global administrator privileges. The fix revalidates updates and introduces _PinnedClientNetwork to enforce a single allowed host for the complete ACME flow. This issue is fixed in version 1.9.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-70666

EUVD

EUVD-2026-61155

Affected Vendors & Products

Vendor	Product	Version / Range
lemur	lemur	1.9.3
netflix	lemur	1.9.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-70666 is a Server-Side Request Forgery (SSRF) vulnerability in the Netflix Lemur ACME client. An attacker with authority-role membership can update an ACME authority's URL to point to a malicious server they control. This server returns internal URLs in responses, tricking Lemur into making JWS-signed requests to internal services during certificate issuance.

Detection Guidance

Check Lemur logs for unusual ACME client requests to internal or unexpected hosts. Monitor network traffic from the Lemur host to detect outbound connections to non-configured ACME servers. Review authority configurations for unauthorized changes to acme_url values.

Impact Analysis

This vulnerability allows an attacker to make unauthorized requests from the Lemur host to internal services, cloud metadata endpoints, or Kubernetes APIs. These requests are signed with JWS, potentially granting access to sensitive data or enabling further attacks within the internal network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Unauthorized internal requests may expose personal or health data, leading to compliance breaches and potential legal consequences.

Mitigation Strategies

Upgrade Lemur to version 1.9.3 or later. Ensure ACME_DIRECTORY_HOST_ALLOWLIST is properly configured to restrict ACME server URLs. Revoke and reissue all certificates issued via vulnerable ACME authorities. Audit existing ACME authorities for unauthorized modifications to acme_url.

Hi! I’m here to help you understand CVE-2026-70666. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70