Server-Side Request Forgery in Lemur TLS Management by Netflix

CVE-2026-55166

What is CVE-2026-55166?

The vulnerability in Lemur, a TLS certificate management tool developed by Netflix, allows authenticated users to manipulate an ACME authority's acme_url with insufficient server-side restrictions. This vulnerability could lead to an attacker gaining access to sensitive cloud instance metadata and internal services, posing a risk of credential exposure. Additionally, the authorization behavior could inadvertently preserve access to certificate key material despite ownership changes. This could potentially allow unauthorized parties to access long-lived PKI private keys. A fix implemented in version 1.9.2 introduces validation through ACME_DIRECTORY_HOST_ALLOWLIST and enhances key-export audit events to capture detailed context regarding the creator and current owner.

References