CVE-2026-55166 in Lemur
Summary
by MITRE • 08/18/2026
Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destination restriction and trigger AcmeHandler.setup_acme_client to make backend requests. An attacker could target cloud instance metadata or internal services from Lemur network context, potentially obtaining credentials available to the host. The advisory also identifies creator-equality authorization behavior that could preserve access to certificate key material after ownership or role changes, with insufficient export_private_key audit context to distinguish that access path. Together, the acme_url server-side request forgery and authorization weakness could expose cloud credentials and long-lived PKI private-key access. The fix adds ACME_DIRECTORY_HOST_ALLOWLIST validation and enriches key-export audit events with creator and current-owner context. This issue is fixed in version 1.9.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
Lemur serves as a centralized platform for managing TLS certificate lifecycles, including the automation of issuance through protocols like ACME. In versions prior to 1.9.2, the application contained critical security flaws related to server-side request forgery and insufficient authorization controls. These vulnerabilities stem from inadequate validation of user-supplied input when configuring Automatic Certificate Management Environment clients and flawed logic governing access control lists for sensitive cryptographic material. The combination of these issues allows authenticated attackers to pivot into internal network segments or cloud infrastructure metadata services, leading to the potential exfiltration of long-lived private keys and cloud provider credentials.
The primary technical flaw involves an ACME server-side request forgery vulnerability within the AcmeHandler.setup_acme_client function. Prior to version 1.9.2, authenticated users could manipulate the acme_url parameter without effective server-side destination restrictions. This lack of validation allowed attackers to specify arbitrary URLs for the backend HTTP client to contact. By directing these requests toward internal endpoints such as cloud instance metadata services or other sensitive internal APIs accessible from Lemur's network context, an attacker can force the application to make authenticated requests on their behalf. This mechanism effectively bypasses standard perimeter defenses because the traffic originates from a trusted internal service account. The attack vector aligns with CWE-918, which addresses Server-Side Request Forgery, and maps to ATT&CK technique T1557, Adversary-in-the-Middle, as it facilitates interception or manipulation of communications between Lemur and backend services.
A secondary but equally severe issue involves the authorization logic surrounding certificate key material exportation. The system exhibited a creator-equality behavior that failed to properly revoke access when ownership or role changes occurred within the organization. Consequently, users who originally created certificates retained the ability to export private keys even after they were reassigned to other teams or individuals with different security clearances. Furthermore, the audit logging for these exports was insufficiently detailed; it did not distinguish between legitimate administrative actions and unauthorized access by former creators due to a lack of context regarding both the creator and the current owner in the log entries. This represents a violation of CWE-284, Improper Access Control, and specifically relates to CWE-613, Insufficient Session Expiration, as well as CWE-778, Insufficient Logging, because it allows persistent unauthorized access and obscures forensic analysis during incident response.
The operational impact of these vulnerabilities is significant for organizations relying on Lemur for PKI management. The ACME SSRF vulnerability enables attackers to probe internal networks, potentially discovering additional services or extracting sensitive data from cloud metadata endpoints that often contain IAM credentials, instance identity documents, and other secrets. Simultaneously, the authorization weakness ensures that compromised accounts or former employees can continue to access private keys indefinitely, undermining the principle of least privilege and complicating key rotation strategies. This dual threat model means that a single authenticated account compromise could lead to both lateral movement within the network and long-term persistence through stolen cryptographic material.
To mitigate these risks, organizations must upgrade Lemur to version 1.9.2 or later immediately upon availability. The fix introduces ACME_DIRECTORY_HOST_ALLOWLIST validation, which restricts backend requests to a predefined list of trusted domains, thereby neutralizing the SSRF vector by preventing connections to arbitrary internal hosts. Additionally, the update enriches key-export audit events with context regarding both the creator and current owner, improving visibility into who is accessing sensitive material and facilitating more accurate forensic investigations. Administrators should also review existing access controls for certificate ownership transitions to ensure that role changes are properly reflected in permission sets, thereby closing the gap left by the previous creator-equality logic until the software update is applied.