CVE-2026-55166

Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destination restriction and trigger AcmeHandler.setup_acme_client to make backend requests. An attacker could target cloud instance metadata or internal services from Lemur network context, potentially obtaining credentials available to the host. The advisory also identifies creator-equality authorization behavior that could preserve access to certificate key material after ownership or role changes, with insufficient export_private_key audit context to distinguish that access path. Together, the acme_url server-side request forgery and authorization weakness could expose cloud credentials and long-lived PKI private-key access. The fix adds ACME_DIRECTORY_HOST_ALLOWLIST validation and enriches key-export audit events with creator and current-owner context. This issue is fixed in version 1.9.2.

• CWE-285
• CWE-639
• CWE-918

• https://github.com/Netflix/lemur/commit/872f6e282542352f2bf3f6e2bcc504ab81e1843d
• https://github.com/Netflix/lemur/releases/tag/v1.9.2
• https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v
• https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55159luci-app-adblock-fast a WebUI for fast, lightweight DNS-base…8.8
• CVE-2026-5516IBM WebSphere Application Server - Liberty 22.0.0.11 through…5.9
• CVE-2026-55162Lemur manages TLS certificate creation. Prior to 1.9.2, lemu…6.3
• CVE-2026-55163Lemur manages TLS certificate creation. Prior to 1.9.2, PUT …6.3
• CVE-2026-55164Lemur manages TLS certificate creation. Prior to 1.9.2, lemu…4.9
• CVE-2026-55165Lemur manages TLS certificate creation. Prior to 1.9.2, the …4.8
• CVE-2026-55168Runtipi is a personal homeserver orchestrator. In 4.10.0 and…6.5
• CVE-2026-55170OpenFGA is an authorization/permission engine built for deve…5.4
• CVE-2026-55173WWBN AVideo is an open source video platform. Versions 29.0 …8.1
• CVE-2026-55175Spinnaker is an open source, multi-cloud continuous delivery…7.5
• CVE-2026-55178GeoLens is a self-hosted geospatial data catalog with semant…7.5
• CVE-2026-55179Joplin is an open source note-taking and to-do application t…6.5