Netflix Lemur up to 1.9.2 Authority Service service.py _validate_acme_url certificate validation

Summaryinfo

A vulnerability, which was classified as problematic, was found in Netflix Lemur up to 1.9.2. This affects the function _validate_acme_url of the file lemur/authorities/service.py of the component Authority Service. The manipulation of the argument acme_url results in certificate validation. This vulnerability is reported as CVE-2026-71303. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic has been found in Netflix Lemur up to 1.9.2. Affected is the function _validate_acme_url of the file lemur/authorities/service.py of the component Authority Service. The manipulation of the argument acme_url with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on integrity. CVE summarizes:

Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the stored acme_url with an internal service or instance-metadata URL such as 169.254.169.254. The next issuance operation loaded that value and passed it to ClientV2.get_directory, causing an outbound request from the Lemur backend. This bypassed the creation-time mitigation for CVE-2026-55166 and could expose internal services or cloud metadata. The fix revalidates acme_url whenever authority options are updated. This issue is fixed in version 1.9.3.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-71303 since 08/05/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1587.003.

Upgrading to version 1.9.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Netflix

Name

• Lemur

Version

• 1.9.0
• 1.9.1
• 1.9.2

Website

• Product: https://github.com/Netflix/lemur/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion