CVE-2026-70666
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
Description
Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and direct setup_acme_client_no_retry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder, authorizations, and finalize URLs chosen by that server. The Lemur ClientV2 followed those URLs without requiring their host to match the configured directory host, allowing JWS-signed requests to internal services or cloud metadata endpoints. The issue required an ACME authority and a user authorized for that authority, but did not require global administrator privileges. The fix revalidates updates and introduces _PinnedClientNetwork to enforce a single allowed host for the complete ACME flow. This issue is fixed in version 1.9.3.
INFO
Published Date :
Aug. 18, 2026, 8:17 p.m.
Last Modified :
Oct. 22, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update Lemur to version 1.9.3.
- Ensure ACME authority configuration is validated.
- Enforce single host for ACME flows.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-70666.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-70666 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-70666
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-70666 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-70666 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 22, 2026
Action Type Old Value New Value Added Translation Title: lemur de Netflix, Description: Lemur gestiona la creación de certificados TLS. Antes de la versión 1.9.3, un miembro con rol de autoridad podía actualizar acme_url a través de PUT /api/1/authorities/ sin revalidación y dirigir setup_acme_client_no_retry a un servidor ACME controlado por un atacante. Las respuestas de directorio y orden de ACME contienen las URL newNonce, newOrder, authorizations y finalize elegidas por ese servidor. El ClienteV2 de Lemur seguía esas URL sin requerir que su host coincidiera con el host de directorio configurado, permitiendo solicitudes firmadas con JWS a servicios internos o puntos finales de metadatos en la nube. El problema requería una autoridad ACME y un usuario autorizado para esa autoridad, pero no requería privilegios de administrador global. La solución revalida las actualizaciones e introduce _PinnedClientNetwork para forzar un único host permitido para el flujo ACME completo. Este problema está solucionado en la versión 1.9.3. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 19, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-70666', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-19T18:04:02.112548Z'} -
New CVE Received by [email protected]
Aug. 18, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Netflix', 'product': 'lemur', 'versions': [{'status': 'affected', 'version': '< 1.9.3'}]}] Added Description Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and direct setup_acme_client_no_retry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder, authorizations, and finalize URLs chosen by that server. The Lemur ClientV2 followed those URLs without requiring their host to match the configured directory host, allowing JWS-signed requests to internal services or cloud metadata endpoints. The issue required an ACME authority and a user authorized for that authority, but did not require global administrator privileges. The fix revalidates updates and introduces _PinnedClientNetwork to enforce a single allowed host for the complete ACME flow. This issue is fixed in version 1.9.3. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L Added CWE CWE-918 Added Reference https://github.com/Netflix/lemur/commit/6dcb19b6d6004e97796d6a0344b130b2ba57f050 Added Reference https://github.com/Netflix/lemur/releases/tag/v1.9.3 Added Reference https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww