# CVE-2026-70667: Netflix Lemur SSRF in certificate revocation checking via redirects and DNS rebinding

Source: https://junglewise.ai/threats/cve-2026-70667-netflix-lemur-ssrf-in-certificate-revocation-checking-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-70667 · Severity: medium · CVSS 6.3 · Published 2026-08-18

Lemur is a certificate management platform used to issue and verify X.509 certificates. An incomplete fix for a prior SSRF vulnerability allows authenticated operators to force Lemur to make requests to internal networks and cloud metadata services by crafting certificates with malicious revocation URLs. The attacker can cause the application to reach unreachable internal services and retrieve metadata, potentially leading to account compromise or cloud infrastructure misconfiguration exposure.

Technologies: [lemur (PyPI)](https://junglewise.ai/threats/technologies/lemur). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-70667 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70667 being exploited in the wild.

**How severe is CVE-2026-70667?** Medium severity, with a CVSS score of 6.3, published 18 August 2026.

**Which products and versions are affected?** lemur (PyPI) < 1.9.3, ECOSYSTEM:introduced=0,fixed=1.9.3.

**Is there a fix for CVE-2026-70667?** Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-70667 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-70667?** Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lemur (PyPI): upgrade to 1.9.3 or later

  ```sh
  pip install "lemur>=1.9.3"
  ```


## Technical details

The vulnerability exists in the certificate revocation checking logic (lemur/certificates/verify.py). Two attack vectors bypass the URL validation: (1) HTTP redirect — the validator checks only the initial URL, but `requests.get()` automatically follows redirects without re-validation, allowing redirect to internal targets; (2) DNS rebinding/TOCTOU — the validator resolves the hostname once during validation, but the actual CRL/OCSP fetch re-resolves independently, allowing a low-TTL name to answer a public IP at check time and an internal IP at fetch time. Exploitation requires operator-level privileges to POST a crafted certificate to `/api/1/certificates/upload` with attacker-controlled `crlDistributionPoints` or OCSP URL extensions. When certificate verification runs (e.g., check_revocation task), the blind SSRF reaches internal services and metadata endpoints (169.254.169.254); responses are parsed as CRL data and discarded. Fixed in version 1.9.3.

## Affected products

- Netflix Lemur < 1.9.3

## Identifiers

- CVE-2026-70667
- GHSA-f3qq-49m6-rw8f
- PYSEC-2026-3676

## Timeline

- 2026-08-18: disclosed: GitHub Advisory published
- 2026-08-18: patched: Fixed in version 1.9.3

## References

- [https://api.github.com/users/abhinav9-coder](https://api.github.com/users/abhinav9-coder)
- [https://github.com/abhinav9-coder](https://github.com/abhinav9-coder)
- [https://api.github.com/users/abhinav9-coder/gists%7B/gist_id%7D](https://api.github.com/users/abhinav9-coder/gists%7B/gist_id%7D)
- [https://api.github.com/users/abhinav9-coder/repos](https://api.github.com/users/abhinav9-coder/repos)
- [https://avatars.githubusercontent.com/u/73783498?v=4](https://avatars.githubusercontent.com/u/73783498?v=4)
- [https://api.github.com/users/abhinav9-coder/events%7B/privacy%7D](https://api.github.com/users/abhinav9-coder/events%7B/privacy%7D)

## Related threats

- [Netflix Lemur arbitrary certificate revocation via duplicate upload](https://junglewise.ai/threats/cve-2026-71417-netflix-lemur-arbitrary-certificate-revocation-via-duplicate)
- [Netflix Lemur missing authorization check on POST /certificates/<id>/export](https://junglewise.ai/threats/cve-2026-71322-netflix-lemur-missing-authorization-check-on-post-certificates-id)
- [Netflix Lemur sub-CA creation authorization bypass](https://junglewise.ai/threats/cve-2026-71317-netflix-lemur-sub-ca-creation-authorization-bypass)
- [Netflix Lemur unchecked replaces authorization bypass](https://junglewise.ai/threats/cve-2026-71308-netflix-lemur-unchecked-replaces-authorization-bypass)
- [Netflix Lemur destinations API authorization bypass](https://junglewise.ai/threats/cve-2026-71307-netflix-lemur-destinations-api-authorization-bypass)