TLS Certificate Management Vulnerability in Lemur by Netflix

CVE-2026-71303

What is CVE-2026-71303?

Lemur, a tool for managing TLS certificates, had a vulnerability that allowed users with authority roles to replace the acme_url with internal service URLs. This issue arose because the system did not consistently enforce the ACME_DIRECTORY_HOST_ALLOWLIST when certain options were updated. As a result, operations could pass potentially sensitive URLs, making internal services or cloud metadata accessible. The vulnerability has been addressed in version 1.9.3, which ensures that acme_url is revalidated whenever authority options are altered.

References