Is CVE-2026-55162 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55162 being exploited in the wild.

How severe is CVE-2026-55162?

Medium severity, with a CVSS score of 6.3, published 18 August 2026.

Which products and versions are affected?

lemur (PyPI) <= 1.9.1, ECOSYSTEM:introduced=0,fixed=1.9.2.

Is there a fix for CVE-2026-55162?

Yes. lemur (PyPI): upgrade to 1.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55162 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55162?

Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55162: Netflix Lemur SSRF in certificate verification via CRL and OCSP URLs

Q: Which products and versions are affected?

lemur (PyPI) <= 1.9.1, ECOSYSTEM:introduced=0,fixed=1.9.2.

Q: Is there a fix for CVE-2026-55162?

Yes. lemur (PyPI): upgrade to 1.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55162 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55162?

Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55162 · Severity: medium · CVSS 6.3 · Published 2026-08-18

Netflix Lemur, a certificate management framework, is vulnerable to a security flaw where it can be forced to make unauthorized requests to internal network services. An authenticated user with operator privileges can upload a specially crafted certificate that directs the server to connect to internal databases, cloud metadata services, or other private infrastructure. This could lead to the exposure of sensitive internal configuration data or allow an attacker to map out the organization's private network.

Technologies: lemur (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55162 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55162 being exploited in the wild.
How severe is CVE-2026-55162?: Medium severity, with a CVSS score of 6.3, published 18 August 2026.
Which products and versions are affected?: lemur (PyPI) <= 1.9.1, ECOSYSTEM:introduced=0,fixed=1.9.2.
Is there a fix for CVE-2026-55162?: Yes. lemur (PyPI): upgrade to 1.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55162 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55162?: Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lemur (PyPI): upgrade to 1.9.2 or later
```
pip install "lemur>=1.9.2"
```

Technical details

A Server-Side Request Forgery (SSRF) exists in `lemur/certificates/verify.py` due to insufficient validation of URLs extracted from certificate extensions. Specifically, the `crl_verify` and `ocsp_verify` functions extract CRL Distribution Point (CDP) and OCSP responder URLs directly from uploaded certificates and pass them to network sinks (`requests.get` and `openssl ocsp -url`) without destination allow-listing or scheme restrictions. An authenticated attacker with the 'operator' role can trigger these requests by uploading a certificate containing URLs pointing to internal resources like RFC1918 addresses or cloud metadata endpoints (IMDS). This can be used for internal network scanning or credential theft in environments without IMDSv2. The issue is fixed in version 1.9.2.

Affected products

Netflix Lemur <= 1.9.1

Identifiers

CVE-2026-55162
GHSA-54vg-pfh7-jq95
PYSEC-2026-2586

Timeline

2026-06-10: patched: Version 1.9.2 released
2026-06-25: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.