Security Issue in TLS Certificate Management by Lemur

CVE-2026-70667

What is CVE-2026-70667?

Lemur, a tool for managing TLS certificate creation, previously had a vulnerability in its _validate_revocation_url function. This issue arose from the method's failure to validate the final destination of the HTTP redirection when retrieving the Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) data. A malicious actor could exploit this flaw by redirecting a request to insecure internal addresses or other unintended destinations, thereby manipulating certificate verification processes. This vulnerability also created a time-of-check to time-of-use window for potential DNS rebinding attacks. It has been mitigated in version 1.9.3 by disallowing redirects and enforcing validation of resolved addresses while maintaining the correct host value.

References