CVE-2026-55162: Lemur TLS Certificate SSRF Vulnerability

CVE-2026-55162 Overview

CVE-2026-55162 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Netflix Lemur, an open-source TLS certificate management platform. Versions prior to 1.9.2 accept CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and pass them to crl_verify and ocsp_verify in lemur/certificates/verify.py without adequate destination validation. An authenticated operator can submit a crafted certificate through POST /api/1/certificates/upload and force the Lemur host to issue outbound requests to internal addresses. The CRL verification path also uses an unbounded cache, enabling attacker-controlled entries to persist in memory.

Critical Impact
Authenticated attackers can force Lemur to reach loopback, RFC1918, link-local, and cloud instance metadata endpoints such as 169.254.169.254, exposing internal services and cloud credentials.

Affected Products

Netflix Lemur versions prior to 1.9.2
Deployments exposing POST /api/1/certificates/upload to authenticated operators
Cloud-hosted Lemur instances with access to instance metadata services

Discovery Timeline

2026-08-18 - CVE-2026-55162 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-55162

Vulnerability Analysis

Lemur validates uploaded TLS certificates by contacting the revocation endpoints embedded in the certificate itself. The pre-patch verify.py module extracted the CRL Distribution Point (CRLDP) and Authority Information Access (AIA) OCSP URLs directly from the submitted certificate and passed them into HTTP request helpers. No allowlist, hostname resolution check, or IP address validation was applied before dispatching the request.

An authenticated operator can upload a certificate whose CRLDP or OCSP URL points to an internal target. Lemur then issues an outbound request from its own host network position, which typically has broader trust than external clients. Cloud deployments are particularly exposed because the instance metadata service at 169.254.169.254 returns short-lived credentials to any process on the host.

The secondary issue is memory consumption. The CRL cache had no bound, so an attacker submitting many certificates with unique attacker-controlled CRL URLs can grow the cache indefinitely.

Root Cause

The root cause is missing destination validation on user-controllable URLs consumed by an outbound HTTP client. The functions crl_verify and ocsp_verify trusted the parsed certificate extensions as safe input. Combined with an unbounded dict-backed CRL cache, this violates SSRF hardening guidance in [CWE-918].

Attack Vector

Exploitation requires an authenticated Lemur operator account. The attacker generates a certificate that lists an internal URL as its CRL Distribution Point or OCSP responder, then submits it through the certificate upload endpoint. Lemur parses the extensions and issues the request, returning error timing or response fingerprints that let the attacker map internal services or trigger side effects on GET-reachable endpoints.

python

     :license: Apache, see LICENSE for more details.
 .. moduleauthor:: Kevin Glisson <kglisson@netflix.com>
 """
+import ipaddress
 import requests
+import socket
 import subprocess
+from collections import OrderedDict
+from urllib.parse import urlparse
 from flask import current_app
 from requests.exceptions import ConnectionError, InvalidSchema, Timeout
 from cryptography import x509

Source: GitHub Lemur Commit 733714a. The patch adds ipaddress, socket, and urlparse imports to resolve and classify destinations, plus OrderedDict to implement a bounded cache.

Detection Methods for CVE-2026-55162

Indicators of Compromise

Outbound HTTP or HTTPS connections from the Lemur host to 169.254.169.254, 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 169.254.0.0/16.
Certificate upload requests to POST /api/1/certificates/upload followed by outbound requests to non-public destinations within the same process context.
Sustained memory growth in the Lemur worker process correlated with repeated certificate uploads from a single operator account.

Detection Strategies

Parse Lemur application and proxy logs to correlate certificates/upload requests with subsequent CRL and OCSP fetches, flagging any target that resolves to a private or link-local range.
Deploy egress filtering telemetry to detect DNS lookups and TCP connections from Lemur pods or hosts to internal metadata endpoints.
Alert on any Lemur outbound request to 169.254.169.254, which has no legitimate use in certificate revocation checks.

Monitoring Recommendations

Enable audit logging on the Lemur certificate upload API and forward events to a centralized SIEM for correlation with network flow data.
Track resident set size of Lemur worker processes and alert on abnormal growth patterns that may indicate CRL cache abuse.
Review operator account activity for unusual upload volumes from a single principal.

How to Mitigate CVE-2026-55162

Immediate Actions Required

Upgrade Netflix Lemur to version 1.9.2 or later, which enforces destination validation and bounds the CRL cache.
Restrict operator role assignments and rotate any credentials that could have been reached through the Lemur host, including cloud instance metadata tokens.
Enforce egress firewall rules that block traffic from Lemur to RFC1918, loopback, and link-local ranges.

Patch Information

The fix is available in Netflix Lemur Release v1.9.2. The corresponding source change is documented in Netflix Lemur commit 733714a and the coordinated disclosure is tracked in GitHub Security Advisory GHSA-54vg-pfh7-jq95. The patch validates URL destinations against resolved IP address classifications, adds explicit trusted-host allowlist support, and replaces the unbounded CRL cache with a size-limited OrderedDict.

Workarounds

Place Lemur behind an egress proxy that denies traffic to internal address ranges and the 169.254.169.254 metadata endpoint until the upgrade is applied.
On cloud providers that support it, require IMDSv2 with session tokens and hop-limit 1 to block SSRF-based credential theft.
Limit the operator role to a minimal trusted set of users and monitor certificate upload activity closely.

bash

# Example egress restriction for a Lemur host using iptables
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT