CVE-2026-55166: Netflix Lemur SSRF and IDOR leading to AWS IAM and PKI compromise

CVE-2026-55166 · Severity: critical · CVSS 9.9 · Published 2026-08-18

Netflix Lemur, a tool for managing security certificates, contains a chain of vulnerabilities that allows any user with a corporate login to compromise the system. An attacker can steal the server's AWS cloud credentials and gain permanent access to private encryption keys, even if the keys are later transferred to a different administrator. This could lead to unauthorized access to sensitive cloud infrastructure and the ability to impersonate secure services indefinitely.

Technologies: lemur (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55166 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55166 being exploited in the wild.
How severe is CVE-2026-55166?
Critical severity, with a CVSS score of 9.9, published 18 August 2026.
Which products and versions are affected?
lemur (PyPI) < 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.2.
Is there a fix for CVE-2026-55166?
Yes. lemur (PyPI): upgrade to 1.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55166 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55166?
Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lemur (PyPI): upgrade to 1.9.2 or later
    pip install "lemur>=1.9.2"

Technical details

A vulnerability chain in Netflix Lemur exists across three components. First, the SSO implementation auto-provisions new federated identities as active users without admin approval. Second, the ACME plugin's authority creation endpoint is vulnerable to Server-Side Request Forgery (SSRF) via the 'acme_url' parameter, allowing an authenticated attacker to query the AWS Instance Metadata Service (IMDS) and exfiltrate IAM role credentials. Third, an Insecure Direct Object Reference (IDOR) in the certificate key-fetch view allows the original creator of a certificate to access its private key indefinitely, bypassing subsequent ownership transfers or permission changes. These issues are patched in version 1.9.2.

Affected products

  • Netflix lemur < 1.9.2

Identifiers

  • CVE-2026-55166
  • GHSA-v2wp-frmc-5q3v
  • PYSEC-2026-384

Timeline

  • 2026-06-10: disclosed: Initial disclosure on GitHub
  • 2026-06-25: advisory: Advisory updated and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.