Executive brief
Lemur is an open-source certificate management platform used to centralize SSL/TLS certificate lifecycle. A flaw in the authority update API allows authenticated users with basic certificate-issuance permissions to overwrite the ACME server URL with an arbitrary address, bypassing the allowlist meant to prevent this. When the next certificate is issued through that authority, Lemur's backend fetches the attacker-controlled URL, enabling server-side request forgery (SSRF) attacks that could expose cloud credentials, probe internal services, or read sensitive metadata.
Technical details
The vulnerability is an incomplete fix for a prior authorization-bypass issue. The original patch added _validate_acme_url() to reject acme_url values not in the ACME_DIRECTORY_HOST_ALLOWLIST, but this validation is only invoked during authority creation (POST /api/1/authorities). The authority update endpoint (PUT /api/1/authorities/<id>) in lemur/authorities/views.py accepts and stores arbitrary options — including modified acme_url — without invoking the allowlist check. Any authenticated user granted membership in an ACME authority's role group can call PUT to overwrite the acme_url. When the next certificate is issued via that authority, lemur/plugins/lemur_acme/acme_handlers.py reads the stored URL and calls ClientV2.get_directory(directory_url, net), triggering an outbound HTTP request to the attacker-supplied URL. This enables SSRF to cloud metadata services (AWS IMDSv1, GCP, Azure) or internal endpoints. The default configuration (LEMUR_STRICT_ROLE_ENFORCEMENT = False) allows any non-read-only user to reach the endpoint. Patched in version 1.9.3.
Affected products
- Netflix Lemur <= 1.9.2
Timeline
- 2026-07-06: disclosed
- 2026-08-18: advisory
- 2026-08-18: patched: Patched in version 1.9.3