CVE-2026-70666

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and direct setup_acme_client_no_retry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder, authorizations, and finalize URLs chosen by that server. The Lemur ClientV2 followed those URLs without requiring their host to match the configured directory host, allowing JWS-signed requests to internal services or cloud metadata endpoints. The issue required an ACME authority and a user authorized for that authority, but did not require global administrator privileges. The fix revalidates updates and introduces _PinnedClientNetwork to enforce a single allowed host for the complete ACME flow. This issue is fixed in version 1.9.3.

• CWE-918

• https://github.com/Netflix/lemur/commit/6dcb19b6d6004e97796d6a0344b130b2ba57f050
• https://github.com/Netflix/lemur/releases/tag/v1.9.3
• https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-70654libvips is a fast image processing library with low memory n…5.8
• CVE-2026-70656Checkmate is an open-source, self-hosted tool designed to tr…4.9
• CVE-2026-70657Copyparty is a portable file server. Prior to 1.20.17, copyp…4.3
• CVE-2026-70658Pay is a payments engine for Ruby on Rails 6.0 and higher. P…7.4
• CVE-2026-7066A vulnerability was found in choieastsea simple-openstack-mc…7.3
• CVE-2026-70665Doorkeeper OpenID Connect implements an OpenID Connect authe…4.2
• CVE-2026-70667Lemur manages TLS certificate creation. Prior to 1.9.3, _val…6.3
• CVE-2026-70668Vulnerability in the Oracle Reports Developer product of Ora…9.1
• CVE-2026-70669Vulnerability in the Oracle Reports Developer product of Ora…9.8
• CVE-2026-7067A vulnerability was determined in D-Link DIR-822 A_101. The …7.3
• CVE-2026-70670Vulnerability in the Oracle Reports Developer product of Ora…7.6
• CVE-2026-70671Vulnerability in the Oracle Reports Developer product of Ora…8.1