CVE-2026-55166: Lemur TLS Certificate Manager SSRF Vulnerability

CVE-2026-55166 Overview

CVE-2026-55166 affects Netflix Lemur, an open-source tool that manages TLS certificate creation. Prior to version 1.9.2, authenticated users could influence an ACME authority acme_url without effective server-side destination restrictions. This condition allows an attacker to trigger AcmeHandler.setup_acme_client and force backend requests to arbitrary endpoints. The advisory also describes a creator-equality authorization behavior that preserves access to certificate key material after ownership or role changes. Together, the Server-Side Request Forgery (SSRF) and authorization weakness [CWE-285] can expose cloud credentials and long-lived PKI private keys.

Critical Impact
Authenticated attackers can pivot Lemur into cloud metadata services and internal endpoints, potentially exfiltrating host credentials and private key material.

Affected Products

Netflix Lemur versions prior to 1.9.2
lemur/plugins/lemur_acme/acme_handlers.py ACME client setup path
lemur/certificates/views.py private key export path

Discovery Timeline

2026-08-18 - CVE-2026-55166 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-55166

Vulnerability Analysis

The vulnerability has two coupled components. First, authenticated users supply an acme_url when configuring an ACME authority. Lemur passes this URL into AcmeHandler.setup_acme_client, which then issues outbound HTTP requests from the Lemur server. Because no allowlist restricted destinations, an attacker could target the cloud instance metadata service (for example, 169.254.169.254) or internal services reachable from the Lemur network context. The response content and headers can be observed indirectly through ACME client behavior, enabling credential theft from IAM roles bound to the host.

Second, the certificate export logic checked equality between the current session user and the certificate creator. That check preserved private key access for the original creator even after ownership or Role-Based Access Control (RBAC) changes. Audit events for export_private_key did not distinguish creator-based access from RBAC-based access, hindering detection.

Root Cause

The root cause is missing destination validation on the ACME directory URL combined with insufficient authorization state tracking. The fix introduces ACME_DIRECTORY_HOST_ALLOWLIST validation and enriches export audit events with creator and current-owner context.

Attack Vector

An authenticated user with authority-management permissions submits an ACME authority whose acme_url points at an internal target. Lemur's ACME handler resolves the URL and issues a request, returning content or side-channel information back to the attacker.

python

# Patch: lemur/certificates/views.py
# Enriches export_private_key audit events with access context
-        log_service.audit_log("export_private_key", cert.name,
-                              "Exported Private key for the certificate")
+        access_via = "creator" if g.current_user == cert.user else "rbac"
+        log_service.audit_log(
+            "export_private_key",
+            cert.name,
+            f"Exported private key. access_via={access_via} creator_id={cert.user_id} current_owner={cert.owner}",
+        )
         return response

Source: Netflix/lemur commit 872f6e2

python

# Patch: lemur/plugins/lemur_acme/acme_handlers.py
# Adds urlparse import to support host allowlist validation
 import json
 import time
 from datetime import datetime, timezone, timedelta
+from urllib.parse import urlparse

 import OpenSSL.crypto
 import dns.resolver

Source: Netflix/lemur commit 872f6e2

Detection Methods for CVE-2026-55166

Indicators of Compromise

Outbound requests from the Lemur host to 169.254.169.254, metadata.google.internal, or other cloud metadata endpoints
ACME authority records with acme_url values pointing to RFC1918 addresses, loopback, or non-ACME hostnames
export_private_key audit entries lacking access_via, creator_id, or current_owner fields on pre-patch installations
Certificate exports performed by former owners after RBAC or ownership changes

Detection Strategies

Review Lemur application logs for setup_acme_client calls that resolve to internal or link-local IP addresses
Correlate ACME authority creation events with subsequent unusual outbound HTTP traffic from the Lemur host
Baseline the set of legitimate ACME directory hosts and alert on deviations

Monitoring Recommendations

Forward Lemur audit logs and web server logs to a centralized log platform for correlation with network telemetry
Monitor egress from the Lemur host and block requests to cloud metadata endpoints at the network layer
Alert on repeated export_private_key events for the same certificate by different principals

How to Mitigate CVE-2026-55166

Immediate Actions Required

Upgrade Lemur to version 1.9.2 or later
Configure ACME_DIRECTORY_HOST_ALLOWLIST with the specific ACME provider hostnames your deployment uses
Audit existing ACME authority records for suspicious acme_url values and rotate any credentials bound to the Lemur host role
Rotate certificates whose private keys were exported by former owners

Patch Information

The fix is available in Netflix Lemur v1.9.2. Technical details are documented in GitHub Security Advisory GHSA-v2wp-frmc-5q3v and the remediation commit.

Workarounds

Restrict Lemur egress traffic with network policies that block access to cloud metadata services and internal management networks
Bind the Lemur host to an IAM role with least-privilege permissions that cannot access sensitive secrets
Limit authority-creation permissions to a small set of trusted operators until the upgrade is applied

bash

# Example: restrict ACME directory hosts in Lemur configuration
ACME_DIRECTORY_HOST_ALLOWLIST = [
    "acme-v02.api.letsencrypt.org",
    "acme.zerossl.com",
]