# CVE-2026-55166: Netflix Lemur SSRF and IDOR leading to AWS IAM and PKI compromise

Source: https://junglewise.ai/threats/cve-2026-55166-netflix-lemur-ssrf-and-idor-leading-to-aws-iam-and-pki-compromise  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-55166 · Severity: critical · CVSS 9.9 · Published 2026-08-18

Netflix Lemur, a tool for managing security certificates, contains a chain of vulnerabilities that allows any user with a corporate login to compromise the system. An attacker can steal the server's AWS cloud credentials and gain permanent access to private encryption keys, even if the keys are later transferred to a different administrator. This could lead to unauthorized access to sensitive cloud infrastructure and the ability to impersonate secure services indefinitely.

Technologies: [lemur (PyPI)](https://junglewise.ai/threats/technologies/lemur). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-55166 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55166 being exploited in the wild.

**How severe is CVE-2026-55166?** Critical severity, with a CVSS score of 9.9, published 18 August 2026.

**Which products and versions are affected?** lemur (PyPI) < 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.2.

**Is there a fix for CVE-2026-55166?** Yes. lemur (PyPI): upgrade to 1.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55166 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55166?** Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lemur (PyPI): upgrade to 1.9.2 or later

  ```sh
  pip install "lemur>=1.9.2"
  ```


## Technical details

A vulnerability chain in Netflix Lemur exists across three components. First, the SSO implementation auto-provisions new federated identities as active users without admin approval. Second, the ACME plugin's authority creation endpoint is vulnerable to Server-Side Request Forgery (SSRF) via the 'acme_url' parameter, allowing an authenticated attacker to query the AWS Instance Metadata Service (IMDS) and exfiltrate IAM role credentials. Third, an Insecure Direct Object Reference (IDOR) in the certificate key-fetch view allows the original creator of a certificate to access its private key indefinitely, bypassing subsequent ownership transfers or permission changes. These issues are patched in version 1.9.2.

## Affected products

- Netflix lemur < 1.9.2

## Identifiers

- CVE-2026-55166
- GHSA-v2wp-frmc-5q3v
- PYSEC-2026-384

## Timeline

- 2026-06-10: disclosed: Initial disclosure on GitHub
- 2026-06-25: advisory: Advisory updated and published

## References

- [https://api.github.com/users/im-rootkid](https://api.github.com/users/im-rootkid)
- [https://github.com/im-rootkid](https://github.com/im-rootkid)
- [https://api.github.com/users/im-rootkid/gists%7B/gist_id%7D](https://api.github.com/users/im-rootkid/gists%7B/gist_id%7D)
- [https://api.github.com/users/im-rootkid/repos](https://api.github.com/users/im-rootkid/repos)
- [https://avatars.githubusercontent.com/u/73109646?v=4](https://avatars.githubusercontent.com/u/73109646?v=4)
- [https://api.github.com/users/im-rootkid/events%7B/privacy%7D](https://api.github.com/users/im-rootkid/events%7B/privacy%7D)

## Related threats

- [Netflix Lemur arbitrary certificate revocation via duplicate upload](https://junglewise.ai/threats/cve-2026-71417-netflix-lemur-arbitrary-certificate-revocation-via-duplicate)
- [Netflix Lemur missing authorization check on POST /certificates/<id>/export](https://junglewise.ai/threats/cve-2026-71322-netflix-lemur-missing-authorization-check-on-post-certificates-id)
- [Netflix Lemur sub-CA creation authorization bypass](https://junglewise.ai/threats/cve-2026-71317-netflix-lemur-sub-ca-creation-authorization-bypass)
- [Netflix Lemur unchecked replaces authorization bypass](https://junglewise.ai/threats/cve-2026-71308-netflix-lemur-unchecked-replaces-authorization-bypass)
- [Netflix Lemur destinations API authorization bypass](https://junglewise.ai/threats/cve-2026-71307-netflix-lemur-destinations-api-authorization-bypass)