CVE-2026-70666: Lemur Auth Bypass Vulnerability

CVE-2026-70666 Overview

CVE-2026-70666 is a Server-Side Request Forgery (SSRF) vulnerability in Netflix Lemur, a tool that manages TLS certificate creation. In versions prior to 1.9.3, an authority-role member could update the acme_url field through PUT /api/1/authorities/ without revalidation. This redirected setup_acme_client_no_retry to an attacker-controlled ACME server. The Lemur ClientV2 followed URLs returned in ACME directory and order responses without validating that their host matched the configured directory host. The flaw is tracked as CWE-918 and is fixed in Lemur 1.9.3.

Critical Impact
An authenticated authority-role user can coerce Lemur into sending JWS-signed HTTPS requests to internal services or cloud metadata endpoints, without global administrator privileges.

Affected Products

Netflix Lemur versions prior to 1.9.3
Deployments configured with an ACME certificate authority
Lemur instances where non-admin users hold the authority role

Discovery Timeline

2026-08-18 - CVE-2026-70666 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-70666

Vulnerability Analysis

The vulnerability arises in Lemur's ACME client integration. The PUT /api/1/authorities/ endpoint accepted updates to the acme_url field without revalidating that the caller was authorized to change the underlying certificate authority endpoint. Once updated, setup_acme_client_no_retry initialized an ACME client against the attacker-controlled URL.

The ACME protocol returns a directory document containing newNonce, newOrder, authorizations, and finalize URLs. Lemur's ClientV2 and ClientNetwork followed these URLs without host pinning. An attacker running a rogue ACME server could return URLs pointing at 169.254.169.254, internal admin panels, or private cloud APIs. Lemur then issued JWS-signed HTTPS requests to those destinations.

Exploitation required an authenticated user assigned to an ACME authority, but did not require global administrator privileges. The blast radius includes cloud instance metadata services, internal HTTP APIs reachable from the Lemur host, and any endpoint that treats source IP as trust.

Root Cause

Two defects combined to create the SSRF. First, the authorities update handler did not revalidate acme_url changes against authorization policy. Second, the ACME client trusted the directory response and honored arbitrary hostnames for subsequent flow steps. Neither layer enforced a single fixed host for the ACME transaction.

Attack Vector

A user with authority-role permissions issues a PUT to /api/1/authorities/{id} setting acme_url to an attacker-controlled endpoint. When Lemur next initiates certificate issuance for that authority, the ACME client fetches the directory from the attacker, then follows attacker-supplied newOrder and related URLs to internal targets.

python

# Security patch in lemur/plugins/lemur_acme/acme_handlers.py
# Introduces urlparse and pinned network handling to enforce a
# single allowed host across the full ACME flow.
 import json
 import time
 from datetime import datetime, timezone, timedelta
+from urllib.parse import urlparse
 
 import OpenSSL.crypto
 import dns.resolver
 import josepy as jose
+import requests
 from acme import challenges, errors, messages
 from acme.client import ClientV2, ClientNetwork
 from acme.errors import TimeoutError

Source: GitHub Commit 6dcb19b

Detection Methods for CVE-2026-70666

Indicators of Compromise

Unexpected PUT /api/1/authorities/ requests that modify the acme_url field.
Outbound HTTPS connections from the Lemur host to non-ACME destinations, including RFC1918 ranges or 169.254.169.254.
ACME directory responses containing hosts that differ from the originally configured authority host.

Detection Strategies

Review Lemur audit logs for authority mutations and correlate against the roster of users authorized to change ACME configuration.
Inspect egress proxy or VPC flow logs for connections originating from the Lemur service account to internal-only IPs during certificate operations.
Alert on ACME client requests where the request Host header does not match the configured directory host.

Monitoring Recommendations

Enable verbose logging on the Lemur ACME plugin and forward records to a centralized log store.
Instrument cloud metadata service access controls (IMDSv2, hop-limit=1) and alert on metadata calls from Lemur hosts.
Monitor for anomalous JWS-signed HTTPS traffic patterns from certificate management infrastructure.

How to Mitigate CVE-2026-70666

Immediate Actions Required

Upgrade Netflix Lemur to version 1.9.3 or later.
Audit all users holding the authority role and revoke unnecessary assignments.
Review recent changes to acme_url values on all configured authorities and revert any unrecognized entries.

Patch Information

The fix landed in commit 6dcb19b and shipped in Lemur v1.9.3. The patch revalidates authority updates and introduces _PinnedClientNetwork, which enforces a single allowed host for the complete ACME flow. See GHSA-xpmj-wjcp-6pww for the full advisory.

Workarounds

Restrict network egress from Lemur to only known ACME provider hostnames using an outbound allowlist.
Enforce IMDSv2 with a hop limit of 1 on cloud instances running Lemur to block metadata SSRF.
Temporarily remove authority-role privileges from users who do not require ACME authority management until the upgrade is applied.

bash

# Example egress allowlist enforced via firewall or proxy
# Permit only sanctioned ACME directory hosts from the Lemur host
iptables -A OUTPUT -p tcp -d acme-v02.api.letsencrypt.org --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT

# Block IMDS access from Lemur if not required
iptables -A OUTPUT -d 169.254.169.254 -j DROP