CVE-2026-70666: Lemur server-side request forgery via ACME authority update

CVE-2026-70666 · Severity: high · CVSS 7.4 · Published 2026-08-18

Lemur is an open-source certificate management platform that automates certificate issuance via ACME (used by Let's Encrypt and other CAs). The platform has a two-part vulnerability: it validates trusted ACME server addresses only when an authority is created, but allows later updates to change the server URL without re-validation. Any user with authority-role membership (typically certificate operators) can exploit this to redirect certificate issuance to a malicious ACME server under their control, which responds with internal URLs. This causes Lemur to send authenticated requests to internal services, potentially exposing metadata, credentials, or services on the network.

Technologies: lemur (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-70666 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-70666 being exploited in the wild.
How severe is CVE-2026-70666?
High severity, with a CVSS score of 7.4, published 18 August 2026.
Which products and versions are affected?
lemur (PyPI) <= 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.3.
Is there a fix for CVE-2026-70666?
Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-70666 attacked?
It is attacked over the network.
Am I affected by CVE-2026-70666?
Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lemur (PyPI): upgrade to 1.9.3 or later
    pip install "lemur>=1.9.3"

Technical details

The vulnerability combines two defects. First, `_validate_acme_url()` in `lemur/plugins/lemur_acme/plugin.py` restricts ACME servers to a hardcoded allowlist (Let's Encrypt, Google Public CA) but runs only during authority creation in the `create_authority()` path. The update endpoint (`PUT /authorities/<id>`) accepts an `options` blob containing `acme_url` with no re-validation. Second, the ACME client follows RFC 8555 by requesting subsequent operation URLs from the ACME server's directory and order responses (newOrder, finalize, authorization URLs), creating a classic ACME-client SSRF. An attacker with authority-role membership (satisfying `AuthorityPermission`) can call the update API with a malicious `acme_url`, then trigger certificate issuance; the ACME client will POST JWS-signed requests to attacker-supplied internal URLs (cloud metadata, Kubernetes API, internal services). Patch version 1.9.3 is available; the fix re-validates `acme_url` on update or pins outbound request hostnames to the configured directory host.

Affected products

  • Netflix Lemur <= 1.9.2

Identifiers

  • CVE-2026-70666
  • GHSA-xpmj-wjcp-6pww
  • PYSEC-2026-3680

Timeline

  • 2026-07-06: disclosed: Published to GitHub Advisory Database
  • 2026-08-18: advisory: Advisory reviewed and updated
  • 2026-08-18: patched: Fixed in version 1.9.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.