# CVE-2026-71303: Lemur ACME authority update endpoint SSRF via URL bypass

Source: https://junglewise.ai/threats/cve-2026-71303-lemur-acme-authority-update-endpoint-ssrf-via-url-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71303 · Severity: high · CVSS 7.7 · Published 2026-08-18

Lemur is an open-source certificate management platform used to centralize SSL/TLS certificate lifecycle. A flaw in the authority update API allows authenticated users with basic certificate-issuance permissions to overwrite the ACME server URL with an arbitrary address, bypassing the allowlist meant to prevent this. When the next certificate is issued through that authority, Lemur's backend fetches the attacker-controlled URL, enabling server-side request forgery (SSRF) attacks that could expose cloud credentials, probe internal services, or read sensitive metadata.

Technologies: [lemur (PyPI)](https://junglewise.ai/threats/technologies/lemur). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-71303 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71303 being exploited in the wild.

**How severe is CVE-2026-71303?** High severity, with a CVSS score of 7.7, published 18 August 2026.

**Which products and versions are affected?** lemur (PyPI) <= 1.9.2, ECOSYSTEM:introduced=0,fixed=1.9.3.

**Is there a fix for CVE-2026-71303?** Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71303 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-71303?** Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lemur (PyPI): upgrade to 1.9.3 or later

  ```sh
  pip install "lemur>=1.9.3"
  ```


## Technical details

The vulnerability is an incomplete fix for a prior authorization-bypass issue. The original patch added _validate_acme_url() to reject acme_url values not in the ACME_DIRECTORY_HOST_ALLOWLIST, but this validation is only invoked during authority creation (POST /api/1/authorities). The authority update endpoint (PUT /api/1/authorities/&lt;id&gt;) in lemur/authorities/views.py accepts and stores arbitrary options — including modified acme_url — without invoking the allowlist check. Any authenticated user granted membership in an ACME authority's role group can call PUT to overwrite the acme_url. When the next certificate is issued via that authority, lemur/plugins/lemur_acme/acme_handlers.py reads the stored URL and calls ClientV2.get_directory(directory_url, net), triggering an outbound HTTP request to the attacker-supplied URL. This enables SSRF to cloud metadata services (AWS IMDSv1, GCP, Azure) or internal endpoints. The default configuration (LEMUR_STRICT_ROLE_ENFORCEMENT = False) allows any non-read-only user to reach the endpoint. Patched in version 1.9.3.

## Affected products

- Netflix Lemur <= 1.9.2

## Identifiers

- CVE-2026-71303
- GHSA-v5rc-cpwc-cfpr
- PYSEC-2026-3679

## Timeline

- 2026-07-06: disclosed
- 2026-08-18: advisory
- 2026-08-18: patched: Patched in version 1.9.3

## References

- [https://api.github.com/users/geo-chen](https://api.github.com/users/geo-chen)
- [https://github.com/geo-chen](https://github.com/geo-chen)
- [https://api.github.com/users/geo-chen/gists%7B/gist_id%7D](https://api.github.com/users/geo-chen/gists%7B/gist_id%7D)
- [https://api.github.com/users/geo-chen/repos](https://api.github.com/users/geo-chen/repos)
- [https://avatars.githubusercontent.com/u/2404584?v=4](https://avatars.githubusercontent.com/u/2404584?v=4)
- [https://api.github.com/users/geo-chen/events%7B/privacy%7D](https://api.github.com/users/geo-chen/events%7B/privacy%7D)

## Related threats

- [Netflix Lemur arbitrary certificate revocation via duplicate upload](https://junglewise.ai/threats/cve-2026-71417-netflix-lemur-arbitrary-certificate-revocation-via-duplicate)
- [Netflix Lemur missing authorization check on POST /certificates/<id>/export](https://junglewise.ai/threats/cve-2026-71322-netflix-lemur-missing-authorization-check-on-post-certificates-id)
- [Netflix Lemur sub-CA creation authorization bypass](https://junglewise.ai/threats/cve-2026-71317-netflix-lemur-sub-ca-creation-authorization-bypass)
- [Netflix Lemur unchecked replaces authorization bypass](https://junglewise.ai/threats/cve-2026-71308-netflix-lemur-unchecked-replaces-authorization-bypass)
- [Netflix Lemur destinations API authorization bypass](https://junglewise.ai/threats/cve-2026-71307-netflix-lemur-destinations-api-authorization-bypass)