CVE-2026-70667
Received Received - Intake

Lemur TLS Certificate CRL Redirect Vulnerability

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, so a public attacker-controlled URL could redirect to loopback, RFC1918, link-local, or instance-metadata addresses. Validation and connection also performed separate DNS resolutions, creating a time-of-check time-of-use window for DNS rebinding on both CRL and OCSP paths. An operator uploading a certificate through POST /api/1/certificates/upload could therefore induce blind internal requests despite the earlier mitigation. The fix disables redirects and pins validated addresses while preserving the correct Host value. This issue is fixed in version 1.9.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-70667
EUVD
EUVD-2026-61151

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lemur lemur to 1.9.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) flaw in Lemur, a TLS certificate management tool. It occurs in the revocation URL validation process where HTTP redirects and DNS rebinding can bypass security checks. Attackers can upload a certificate with a malicious CRL or OCSP URL that redirects to internal addresses like loopback or RFC1918 ranges during verification. The issue arises because the system validates the URL once but fetches it separately, allowing time-of-check time-of-use (TOCTOU) attacks. The fix pins the resolved IP address and disables redirects to prevent these bypasses.

Detection Guidance

To detect this vulnerability, monitor outbound HTTP/HTTPS requests from Lemur servers, particularly to internal or unexpected addresses. Check logs for CRL or OCSP fetches to loopback, RFC1918, or link-local addresses. Use network traffic analysis tools like tcpdump or Wireshark to inspect requests to 169.254.169.254 or similar metadata endpoints.

Impact Analysis

An attacker with operator privileges could exploit this to induce Lemur to make blind internal requests to unauthorized services. This includes accessing internal networks, loopback interfaces, or instance metadata (e.g., 169.254.169.254). While data exfiltration isn't possible due to discarded responses, the attacker can probe internal services, trigger side effects, or access sensitive instance metadata. The impact is limited to reachability and potential side-channel attacks.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized internal network access from a system handling TLS certificates. For GDPR, it may expose internal services to unauthorized probing, risking data protection principles. For HIPAA, it could enable access to internal systems that process protected health information. The SSRF risk undermines network segmentation and access control measures required by these standards.

Mitigation Strategies
  • Upgrade Lemur to version 1.9.3 or later to apply the SSRF fixes in revocation URL validation.
  • Disable HTTP redirects during CRL fetches by setting allow_redirects=False in requests.
  • Pin resolved IPs for CRL/OCSP URLs and enforce strict Host headers to prevent DNS rebinding.
  • Reject hostnames resolving to internal addresses (RFC1918, loopback, link-local) during validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart