Quick answers
- Is CVE-2026-70667 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-70667 being exploited in the wild.
- How severe is CVE-2026-70667?
- Medium severity, with a CVSS score of 6.3, published 18 August 2026.
- Which products and versions are affected?
- lemur (PyPI) < 1.9.3, ECOSYSTEM:introduced=0,fixed=1.9.3.
- Is there a fix for CVE-2026-70667?
- Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-70667 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-70667?
- Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- lemur (PyPI): upgrade to 1.9.3 or later
pip install "lemur>=1.9.3"
Technical details
The vulnerability exists in the certificate revocation checking logic (lemur/certificates/verify.py). Two attack vectors bypass the URL validation: (1) HTTP redirect — the validator checks only the initial URL, but `requests.get()` automatically follows redirects without re-validation, allowing redirect to internal targets; (2) DNS rebinding/TOCTOU — the validator resolves the hostname once during validation, but the actual CRL/OCSP fetch re-resolves independently, allowing a low-TTL name to answer a public IP at check time and an internal IP at fetch time. Exploitation requires operator-level privileges to POST a crafted certificate to `/api/1/certificates/upload` with attacker-controlled `crlDistributionPoints` or OCSP URL extensions. When certificate verification runs (e.g., check_revocation task), the blind SSRF reaches internal services and metadata endpoints (169.254.169.254); responses are parsed as CRL data and discarded. Fixed in version 1.9.3.
Affected products
- Netflix Lemur < 1.9.3
Identifiers
- CVE-2026-70667
- GHSA-f3qq-49m6-rw8f
- PYSEC-2026-3676
Timeline
- 2026-08-18: disclosed: GitHub Advisory published
- 2026-08-18: patched: Fixed in version 1.9.3
References
- https://api.github.com/users/abhinav9-coder
- https://github.com/abhinav9-coder
- https://api.github.com/users/abhinav9-coder/gists%7B/gist_id%7D
- https://api.github.com/users/abhinav9-coder/repos
- https://avatars.githubusercontent.com/u/73783498?v=4
- https://api.github.com/users/abhinav9-coder/events%7B/privacy%7D