CVE-2026-55166: Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective

Executive brief

Netflix Lemur, a tool for managing security certificates, contains a chain of vulnerabilities that allows any user with a corporate login to compromise the system. An attacker can steal the server's AWS cloud credentials and gain permanent access to private encryption keys, even if the keys are later transferred to a different administrator. This could lead to unauthorized access to sensitive cloud infrastructure and the ability to impersonate secure services indefinitely.

Technical details

A vulnerability chain in Netflix Lemur exists across three components. First, the SSO implementation auto-provisions new federated identities as active users without admin approval. Second, the ACME plugin's authority creation endpoint is vulnerable to Server-Side Request Forgery (SSRF) via the 'acme_url' parameter, allowing an authenticated attacker to query the AWS Instance Metadata Service (IMDS) and exfiltrate IAM role credentials. Third, an Insecure Direct Object Reference (IDOR) in the certificate key-fetch view allows the original creator of a certificate to access its private key indefinitely, bypassing subsequent ownership transfers or permission changes. These issues are patched in version 1.9.2.

Affected products

• Netflix lemur < 1.9.2

Timeline

• 2026-06-10: disclosed: Initial disclosure on GitHub
• 2026-06-25: advisory: Advisory updated and published

References

• https://api.github.com/users/im-rootkid
• https://github.com/im-rootkid
• https://api.github.com/users/im-rootkid/gists%7B/gist_id%7D
• https://api.github.com/users/im-rootkid/repos
• https://avatars.githubusercontent.com/u/73109646?v=4
• https://api.github.com/users/im-rootkid/events%7B/privacy%7D