CVE-2026-71303

Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the stored acme_url with an internal service or instance-metadata URL such as 169.254.169.254. The next issuance operation loaded that value and passed it to ClientV2.get_directory, causing an outbound request from the Lemur backend. This bypassed the creation-time mitigation for CVE-2026-55166 and could expose internal services or cloud metadata. The fix revalidates acme_url whenever authority options are updated. This issue is fixed in version 1.9.3.

• CWE-918

• https://github.com/Netflix/lemur/commit/edca0390f930344d65ff4ca37a669c2320e3dfad
• https://github.com/Netflix/lemur/releases/tag/v1.9.3
• https://github.com/Netflix/lemur/security/advisories/GHSA-v5rc-cpwc-cfpr
• https://github.com/Netflix/lemur/security/advisories/GHSA-v5rc-cpwc-cfpr

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71291Bolt CMS renders content field values through Twig's full ap…8.8
• CVE-2026-71292Subrion CMS's admin grid sorting helper, _gridGetSorting in …7.2
• CVE-2026-71293Statamic CMS's user-augmentation resolver, AugmentedUser::ge…6.2
• CVE-2026-71294Cotonti CMS's Comments plugin deserializes user-supplied dat…7.6
• CVE-2026-7130A flaw has been found in SourceCodester Pharmacy Sales and I…7.3
• CVE-2026-71300Improper input validation vulnerability in Apache Camel Atmo…9.8
• CVE-2026-71307Lemur manages TLS certificate creation. Prior to 1.9.3, GET …7.7
• CVE-2026-71308Lemur manages TLS certificate creation. From 0.5.0 until 1.9…8.1
• CVE-2026-71309rclone is a command-line program to sync files and directori…8.6
• CVE-2026-7131A vulnerability has been found in code-projects Online Lot R…7.3
• CVE-2026-71310rclone is a command-line program to sync files and directori…5.9
• CVE-2026-71311rclone is a command-line program to sync files and directori…6.4