CVE-2026-70667: Lemur TLS Certificate SSRF Vulnerability

CVE-2026-70667 Overview

CVE-2026-70667 is a Server-Side Request Forgery (SSRF) vulnerability in Netflix Lemur, a TLS certificate management platform. Versions prior to 1.9.3 contain a flaw in _validate_revocation_url within lemur/certificates/verify.py. The validator inspected the original Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) URL, but the subsequent requests.get call followed HTTP redirects without re-validating each Location target. Separate Domain Name System (DNS) resolutions during validation and connection also introduced a Time-of-Check Time-of-Use (TOCTOU) window enabling DNS rebinding. Authenticated operators uploading certificates via POST /api/1/certificates/upload could trigger blind internal requests to loopback, RFC1918, link-local, or cloud instance-metadata endpoints.

Critical Impact
Authenticated operators can coerce the Lemur server into issuing blind HTTP requests to internal network resources, including cloud instance metadata services, potentially exposing credentials and internal infrastructure.

Affected Products

Netflix Lemur versions prior to 1.9.3
Deployments exposing POST /api/1/certificates/upload to operator accounts
Environments where Lemur has network reachability to internal services or cloud metadata endpoints

Discovery Timeline

2026-08-18 - CVE-2026-70667 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-70667

Vulnerability Analysis

The vulnerability is a classic TOCTOU race condition ([CWE-367]) combined with an SSRF filter bypass through HTTP redirects. Lemur's certificate upload workflow validates the CRL and OCSP URLs embedded in a submitted certificate before contacting them to check revocation status. The prior mitigation rejected URLs pointing to private, loopback, or link-local destinations at parse time. However, the validation and subsequent network request executed as two independent operations, each performing its own DNS lookup. An attacker-controlled hostname could resolve to a public address during validation and a private address at connection time.

Root Cause

Two distinct defects combine to defeat the SSRF filter. First, _validate_revocation_url only inspected the initial URL string, while the requests.get invocation followed HTTP 3xx redirects to arbitrary Location targets without re-applying the address policy. Second, validation and connection performed independent DNS resolutions, creating a rebinding window on both CRL and OCSP paths.

Attack Vector

An operator with certificate upload privileges submits a certificate whose CRL or OCSP Authority Information Access (AIA) extension references an attacker-controlled hostname. The attacker either returns an HTTP redirect pointing to 169.254.169.254, 127.0.0.1, or an RFC1918 address, or serves alternating DNS answers to exploit the rebinding window. Lemur then issues the internal request while preserving the attacker's intended Host header context.

python

     Reject URLs that point at private/loopback/link-local destinations (SSRF prevention).
     If config_key is present in app config, also enforce a hostname allowlist.
 
+    Returns the resolved IP string so callers can pin the connection and prevent DNS rebinding.
     Raises ValueError with a descriptive message if the URL is not permitted.
     """
     parsed = urlparse(url)

Source: Netflix Lemur patch commit ed504a8. The fix disables HTTP redirects and pins the validated IP address for the actual connection while preserving the correct Host header for TLS Server Name Indication (SNI) and virtual hosting.

Detection Methods for CVE-2026-70667

Indicators of Compromise

Outbound HTTP requests from the Lemur host to RFC1918, loopback (127.0.0.0/8), link-local (169.254.0.0/16), or cloud metadata endpoints such as 169.254.169.254
Certificate upload payloads whose CRL Distribution Points or Authority Information Access extensions reference untrusted or newly registered domains
HTTP 3xx redirect responses observed by the Lemur egress proxy where the redirect target is a private-range address

Detection Strategies

Inspect Lemur application logs for calls to _validate_revocation_url followed by unexpected internal HTTP destinations
Correlate POST /api/1/certificates/upload events with subsequent DNS queries showing short Time-To-Live (TTL) values or answers alternating between public and private IPs
Monitor for requests library egress that bypasses the organization's forward proxy

Monitoring Recommendations

Enable egress filtering that blocks Lemur workloads from reaching cloud metadata services and internal management planes
Log all DNS resolutions performed by the Lemur process and alert on hostnames resolving to private addresses
Audit certificate upload operator activity and flag uploads containing non-corporate revocation URLs

How to Mitigate CVE-2026-70667

Immediate Actions Required

Upgrade Netflix Lemur to version 1.9.3 or later, which disables redirect following and pins validated IP addresses for revocation requests
Restrict POST /api/1/certificates/upload to a minimal set of trusted operators and enforce multi-factor authentication
Apply network egress controls that prevent Lemur from reaching loopback, RFC1918, link-local, and cloud metadata address ranges

Patch Information

The fix is available in Netflix Lemur release v1.9.3 and detailed in GHSA-f3qq-49m6-rw8f and GHSA-54vg-pfh7-jq95. The patch in commit ed504a8 modifies _validate_revocation_url to return the resolved IP address so callers can bind the connection to that address, and it removes HTTP redirect following on CRL and OCSP retrievals.

Workarounds

Deploy Lemur behind an authenticated forward proxy that enforces destination allowlists for outbound CRL and OCSP traffic
Configure host-based firewall rules blocking access from the Lemur workload to 169.254.169.254 and internal administrative subnets
Require Instance Metadata Service Version 2 (IMDSv2) on Amazon Web Services (AWS) hosts to defeat unauthenticated metadata reads from SSRF primitives

bash

# Example iptables egress restriction for the Lemur host
iptables -A OUTPUT -m owner --uid-owner lemur -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lemur -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lemur -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lemur -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lemur -d 192.168.0.0/16 -j REJECT