CVE-2026-71303: Lemur Information Disclosure Vulnerability

CVE-2026-71303 Overview

CVE-2026-71303 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Netflix Lemur, an open-source TLS certificate management tool. The flaw affects Lemur versions prior to 1.9.3 and represents an incomplete fix for CVE-2026-55166. The prior patch validated the ACME acme_url against ACME_DIRECTORY_HOST_ALLOWLIST only during authority creation. The update path PUT /api/1/authorities/<id> stored the options payload verbatim without re-validation. A user with an authority role could overwrite acme_url with an internal or instance-metadata address such as 169.254.169.254, forcing the backend to fetch attacker-controlled URLs on the next certificate issuance.

Critical Impact
An authenticated user can coerce the Lemur backend into issuing outbound requests to internal services or cloud instance metadata endpoints, exposing credentials and internal infrastructure.

Affected Products

Netflix Lemur versions prior to 1.9.3
Lemur ACME plugin (lemur/plugins/lemur_acme/plugin.py)
Lemur authorities service (lemur/authorities/service.py)

Discovery Timeline

2026-08-18 - CVE-2026-71303 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-71303

Vulnerability Analysis

Lemur exposes an ACME authority abstraction that stores an acme_url pointing to the ACME directory endpoint used for certificate issuance. In version 1.9.2, the _validate_acme_url helper enforced the ACME_DIRECTORY_HOST_ALLOWLIST when a new authority was created. That check was not reapplied when authority options were updated. The PUT /api/1/authorities/<id> endpoint accepted the JSON options payload and wrote it directly to authority.options without inspection.

Any user with a role on an existing ACME authority could overwrite the stored acme_url. On the next issuance, Lemur loaded the modified value and passed it to ClientV2.get_directory, which performed an outbound HTTP request from the Lemur backend to that URL. Because the request originates from the backend, network-restricted internal services and cloud metadata services become reachable.

Root Cause

The root cause is missing input validation on state-changing update operations. The creation path enforced an allowlist while the update path treated options as opaque data. Server-side validation must be applied to every code path that mutates security-sensitive state, not only at record creation.

Attack Vector

An authenticated user holding an authority role sends a PUT /api/1/authorities/<id> request with an options payload where acme_url points to an internal address such as http://169.254.169.254/latest/meta-data/. When any subsequent certificate issuance triggers a directory fetch, the Lemur backend issues an HTTP request to the attacker-controlled URL. Cloud metadata responses can include temporary IAM credentials.

python

    authority.description = description
    authority.owner = owner
    if options:
        # acme_url can be changed here too, so it must be re-validated against the
        # allowlist the same way it is at authority creation time (GHSA-v5rc-cpwc-cfpr)
        from lemur.plugins.lemur_acme.plugin import validate_acme_url

        for option in json.loads(options):
            if option.get("name") == "acme_url":
                validate_acme_url(option.get("value", ""))
        authority.options = options

    log_service.audit_log("update_authority", authority.name, "Updating authority")

Source: Netflix Lemur commit edca0390

Detection Methods for CVE-2026-71303

Indicators of Compromise

Outbound HTTP requests from the Lemur backend to RFC1918 addresses or link-local metadata endpoints such as 169.254.169.254, metadata.google.internal, or metadata.azure.com.
Audit log entries showing update_authority events immediately followed by unusual issuance activity.
Stored acme_url values in the authorities table that do not match entries in ACME_DIRECTORY_HOST_ALLOWLIST.

Detection Strategies

Inspect Lemur database authority.options for acme_url values pointing outside the configured allowlist.
Alert on egress connections from Lemur application hosts to cloud metadata IP ranges.
Correlate PUT /api/1/authorities/ API calls with subsequent certificate issuance events to identify option tampering.

Monitoring Recommendations

Enable and forward Lemur audit logs to a centralized SIEM for review of authority modifications.
Baseline expected outbound destinations from Lemur workers and alert on deviations.
Require change tickets for any authority option updates and reconcile against audit logs.

How to Mitigate CVE-2026-71303

Immediate Actions Required

Upgrade Netflix Lemur to version 1.9.3 or later, which re-validates acme_url on authority update.
Audit existing ACME authorities and reset any acme_url values that fall outside the configured allowlist.
Restrict which users hold authority roles and review role assignments for least privilege.

Patch Information

The fix is available in Netflix Lemur v1.9.3. The patch in lemur/authorities/service.py invokes validate_acme_url for each acme_url option submitted through the update path. See the GitHub Release v1.9.3 and the GitHub Security Advisory GHSA-v5rc-cpwc-cfpr for details.

Workarounds

Block egress from Lemur backend hosts to instance metadata addresses using host firewall rules or IMDSv2 enforcement on AWS.
Restrict egress from Lemur workers to only the approved ACME directory hostnames at the network layer.
Temporarily remove authority roles from non-administrative users until the upgrade is applied.

bash

# Example: block IMDS access from the Lemur host as a defense-in-depth measure
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner lemur -j REJECT

# On AWS, enforce IMDSv2 so token-less SSRF fetches fail
aws ec2 modify-instance-metadata-options \
    --instance-id i-0123456789abcdef0 \
    --http-tokens required \
    --http-endpoint enabled