Executive brief
Lemur is an open-source certificate management platform that automates certificate issuance via ACME (used by Let's Encrypt and other CAs). The platform has a two-part vulnerability: it validates trusted ACME server addresses only when an authority is created, but allows later updates to change the server URL without re-validation. Any user with authority-role membership (typically certificate operators) can exploit this to redirect certificate issuance to a malicious ACME server under their control, which responds with internal URLs. This causes Lemur to send authenticated requests to internal services, potentially exposing metadata, credentials, or services on the network.
Technical details
The vulnerability combines two defects. First, `_validate_acme_url()` in `lemur/plugins/lemur_acme/plugin.py` restricts ACME servers to a hardcoded allowlist (Let's Encrypt, Google Public CA) but runs only during authority creation in the `create_authority()` path. The update endpoint (`PUT /authorities/<id>`) accepts an `options` blob containing `acme_url` with no re-validation. Second, the ACME client follows RFC 8555 by requesting subsequent operation URLs from the ACME server's directory and order responses (newOrder, finalize, authorization URLs), creating a classic ACME-client SSRF. An attacker with authority-role membership (satisfying `AuthorityPermission`) can call the update API with a malicious `acme_url`, then trigger certificate issuance; the ACME client will POST JWS-signed requests to attacker-supplied internal URLs (cloud metadata, Kubernetes API, internal services). Patch version 1.9.3 is available; the fix re-validates `acme_url` on update or pins outbound request hostnames to the configured directory host.
Affected products
- Netflix Lemur <= 1.9.2
Timeline
- 2026-07-06: disclosed: Published to GitHub Advisory Database
- 2026-08-18: advisory: Advisory reviewed and updated
- 2026-08-18: patched: Fixed in version 1.9.3