CVE-2026-55162: Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs

Executive brief

Netflix Lemur, a certificate management framework, is vulnerable to a security flaw where it can be forced to make unauthorized requests to internal network services. An authenticated user with operator privileges can upload a specially crafted certificate that directs the server to connect to internal databases, cloud metadata services, or other private infrastructure. This could lead to the exposure of sensitive internal configuration data or allow an attacker to map out the organization's private network.

Technical details

A Server-Side Request Forgery (SSRF) exists in `lemur/certificates/verify.py` due to insufficient validation of URLs extracted from certificate extensions. Specifically, the `crl_verify` and `ocsp_verify` functions extract CRL Distribution Point (CDP) and OCSP responder URLs directly from uploaded certificates and pass them to network sinks (`requests.get` and `openssl ocsp -url`) without destination allow-listing or scheme restrictions. An authenticated attacker with the 'operator' role can trigger these requests by uploading a certificate containing URLs pointing to internal resources like RFC1918 addresses or cloud metadata endpoints (IMDS). This can be used for internal network scanning or credential theft in environments without IMDSv2. The issue is fixed in version 1.9.2.

Affected products

• Netflix Lemur <= 1.9.1

Timeline

• 2026-06-10: patched: Version 1.9.2 released
• 2026-06-25: disclosed: GitHub Advisory published

References

• https://api.github.com/users/sour-exploit
• https://github.com/sour-exploit
• https://api.github.com/users/sour-exploit/gists%7B/gist_id%7D
• https://api.github.com/users/sour-exploit/repos
• https://avatars.githubusercontent.com/u/288231323?v=4
• https://api.github.com/users/sour-exploit/events%7B/privacy%7D