# CVE-2026-55162: Netflix Lemur SSRF in certificate verification via CRL and OCSP URLs

Source: https://junglewise.ai/threats/cve-2026-55162-netflix-lemur-ssrf-in-certificate-verification-via-crl-and-ocsp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-55162 · Severity: medium · CVSS 6.3 · Published 2026-08-18

Netflix Lemur, a certificate management framework, is vulnerable to a security flaw where it can be forced to make unauthorized requests to internal network services. An authenticated user with operator privileges can upload a specially crafted certificate that directs the server to connect to internal databases, cloud metadata services, or other private infrastructure. This could lead to the exposure of sensitive internal configuration data or allow an attacker to map out the organization's private network.

Technologies: [lemur (PyPI)](https://junglewise.ai/threats/technologies/lemur). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-55162 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55162 being exploited in the wild.

**How severe is CVE-2026-55162?** Medium severity, with a CVSS score of 6.3, published 18 August 2026.

**Which products and versions are affected?** lemur (PyPI) <= 1.9.1, ECOSYSTEM:introduced=0,fixed=1.9.2.

**Is there a fix for CVE-2026-55162?** Yes. lemur (PyPI): upgrade to 1.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55162 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55162?** Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lemur (PyPI): upgrade to 1.9.2 or later

  ```sh
  pip install "lemur>=1.9.2"
  ```


## Technical details

A Server-Side Request Forgery (SSRF) exists in `lemur/certificates/verify.py` due to insufficient validation of URLs extracted from certificate extensions. Specifically, the `crl_verify` and `ocsp_verify` functions extract CRL Distribution Point (CDP) and OCSP responder URLs directly from uploaded certificates and pass them to network sinks (`requests.get` and `openssl ocsp -url`) without destination allow-listing or scheme restrictions. An authenticated attacker with the 'operator' role can trigger these requests by uploading a certificate containing URLs pointing to internal resources like RFC1918 addresses or cloud metadata endpoints (IMDS). This can be used for internal network scanning or credential theft in environments without IMDSv2. The issue is fixed in version 1.9.2.

## Affected products

- Netflix Lemur <= 1.9.1

## Identifiers

- CVE-2026-55162
- GHSA-54vg-pfh7-jq95
- PYSEC-2026-2586

## Timeline

- 2026-06-10: patched: Version 1.9.2 released
- 2026-06-25: disclosed: GitHub Advisory published

## References

- [https://api.github.com/users/sour-exploit](https://api.github.com/users/sour-exploit)
- [https://github.com/sour-exploit](https://github.com/sour-exploit)
- [https://api.github.com/users/sour-exploit/gists%7B/gist_id%7D](https://api.github.com/users/sour-exploit/gists%7B/gist_id%7D)
- [https://api.github.com/users/sour-exploit/repos](https://api.github.com/users/sour-exploit/repos)
- [https://avatars.githubusercontent.com/u/288231323?v=4](https://avatars.githubusercontent.com/u/288231323?v=4)
- [https://api.github.com/users/sour-exploit/events%7B/privacy%7D](https://api.github.com/users/sour-exploit/events%7B/privacy%7D)

## Related threats

- [Netflix Lemur arbitrary certificate revocation via duplicate upload](https://junglewise.ai/threats/cve-2026-71417-netflix-lemur-arbitrary-certificate-revocation-via-duplicate)
- [Netflix Lemur missing authorization check on POST /certificates/<id>/export](https://junglewise.ai/threats/cve-2026-71322-netflix-lemur-missing-authorization-check-on-post-certificates-id)
- [Netflix Lemur sub-CA creation authorization bypass](https://junglewise.ai/threats/cve-2026-71317-netflix-lemur-sub-ca-creation-authorization-bypass)
- [Netflix Lemur unchecked replaces authorization bypass](https://junglewise.ai/threats/cve-2026-71308-netflix-lemur-unchecked-replaces-authorization-bypass)
- [Netflix Lemur destinations API authorization bypass](https://junglewise.ai/threats/cve-2026-71307-netflix-lemur-destinations-api-authorization-bypass)