CVE-2026-70667

Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, so a public attacker-controlled URL could redirect to loopback, RFC1918, link-local, or instance-metadata addresses. Validation and connection also performed separate DNS resolutions, creating a time-of-check time-of-use window for DNS rebinding on both CRL and OCSP paths. An operator uploading a certificate through POST /api/1/certificates/upload could therefore induce blind internal requests despite the earlier mitigation. The fix disables redirects and pins validated addresses while preserving the correct Host value. This issue is fixed in version 1.9.3.

• CWE-367
• CWE-918

• https://github.com/Netflix/lemur/commit/ed504a830f38a83825b1570302e9f38d6553938a
• https://github.com/Netflix/lemur/releases/tag/v1.9.3
• https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f
• https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-70656Checkmate is an open-source, self-hosted tool designed to tr…4.9
• CVE-2026-70657Copyparty is a portable file server. Prior to 1.20.17, copyp…4.3
• CVE-2026-70658Pay is a payments engine for Ruby on Rails 6.0 and higher. P…7.4
• CVE-2026-7066A vulnerability was found in choieastsea simple-openstack-mc…7.3
• CVE-2026-70665Doorkeeper OpenID Connect implements an OpenID Connect authe…4.2
• CVE-2026-70666Lemur manages TLS certificate creation. Prior to 1.9.3, an a…7.4
• CVE-2026-70668Vulnerability in the Oracle Reports Developer product of Ora…9.1
• CVE-2026-70669Vulnerability in the Oracle Reports Developer product of Ora…9.8
• CVE-2026-7067A vulnerability was determined in D-Link DIR-822 A_101. The …7.3
• CVE-2026-70670Vulnerability in the Oracle Reports Developer product of Ora…7.6
• CVE-2026-70671Vulnerability in the Oracle Reports Developer product of Ora…8.1
• CVE-2026-70672Vulnerability in the Oracle Reports Developer product of Ora…7.4