https://vulnerability.circl.lu/sightings/feed 2026-08-20T19:10:02.577570+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/23d21215-9606-4462-b394-5a8e0dd1451d/export 2026-08-20T19:10:02.598868+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "23d21215-9606-4462-b394-5a8e0dd1451d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55166", "type": "seen", "source": "https://gist.github.com/alon710/048e89a8b6d23388e5627d9e6207e2ad", "content": "# CVE-2026-71303: CVE-2026-71303: Server-Side Request Forgery Bypass in Netflix Lemur Authority Updates\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71303\n\n## Summary\nNetflix Lemur, an open-source TLS certificate management framework, is affected by a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability arises from an incomplete patch for a previous security flaw, CVE-2026-55166. While Lemur version 1.9.2 validated the ACME directory URL against an allowlist during authority creation, it failed to perform the same checks when updating existing authorities. An authenticated user possessing an authority role can exploit this omission to replace the directory URL with internal or cloud metadata endpoints. During subsequent certificate issuance, the Lemur backend executes unauthorized requests, potentially leaking sensitive metadata or credentials.\n\n## TL;DR\nAn incomplete patch in Netflix Lemur allows users with authority roles to bypass host allowlists. By submitting a crafted PUT request, attackers can overwrite the ACME directory URL with internal IP addresses, causing the Lemur backend to perform unauthorized outbound connections.\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS Severity**: 7.7 High\n- **EPSS Score**: Not Calculated\n- **Impact**: Server-Side Request Forgery leading to unauthorized internal access or credential leakage\n- **Exploit Status**: No public weaponized exploits available\n- **KEV Status**: Not listed in CISA KEV Catalog\n\n## Affected Systems\n\n- Netflix Lemur certificate management environments deployed prior to version 1.9.3\n- **Lemur**: < 1.9.3 (Fixed in: `1.9.3`)\n\n## Mitigation\n\n- Upgrade Netflix Lemur to version 1.9.3 or newer to ensure all authority modifications are validated\n- Implement host-level iptables or routing rules to block outgoing traffic to 169.254.169.254 from the Lemur application process\n- Enforce AWS IMDSv2 with a hop limit of 1 to prevent metadata access from application runtimes\n- Restrict outbound API network access to known, trusted external ACME directory domains via firewalls or security groups\n\n**Remediation Steps:**\n1. Locate the current Lemur installation path and verify the active version\n2. Retrieve the updated code from the official repository or package manager for version 1.9.3\n3. Apply database migrations and restart the Lemur application services\n4. Review user role permissions to ensure only administrative accounts can modify ACME authorities\n\n## References\n\n- [GitHub Security Advisory GHSA-v5rc-cpwc-cfpr](https://github.com/Netflix/lemur/security/advisories/GHSA-v5rc-cpwc-cfpr)\n- [Netflix Lemur Fix Commit edca0390f930344d65ff4ca37a669c2320e3dfad](https://github.com/Netflix/lemur/commit/edca0390f930344d65ff4ca37a669c2320e3dfad)\n- [Netflix Lemur Release Tag v1.9.3](https://github.com/Netflix/lemur/releases/tag/v1.9.3)\n- [GitHub Security Advisory GHSA-v2wp-frmc-5q3v (CVE-2026-55166)](https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v)\n- [CVE-2026-71303 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71303)\n- [NVD Vulnerability Details for CVE-2026-71303](https://nvd.nist.gov/vuln/detail/CVE-2026-71303)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71303) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T07:31:59.393785Z"} 2026-08-19T07:31:59.393785+00:00 https://vulnerability.circl.lu/sighting/37cde1af-e453-48bd-bf6e-e44f5396bc47/export 2026-08-20T19:10:02.600907+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "37cde1af-e453-48bd-bf6e-e44f5396bc47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55166", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtf5gu7twc25", "content": "CVE-2026-55166 - lemur\nA user with a valid SSO account can access and steal AWS IAM credentials and permanent TLS private keys from a Lemur installation. This can happen if Lemur trusts the user's\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#lemur #netflix #pip #CVE #infosec", "creation_timestamp": "2026-08-18T21:20:04.686753Z"} 2026-08-18T21:20:04.686753+00:00 https://vulnerability.circl.lu/sighting/8bf5b7e3-19bc-43e0-a295-4545461e98ee/export 2026-08-20T19:10:02.600999+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8bf5b7e3-19bc-43e0-a295-4545461e98ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55166", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/c4lpxm7rvj5zg", "content": "CVE-2026-55166 - Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR\nCVE ID : CVE-2026-55166\n \n Published : 18 ao\u00fbt 2026 19:16 | 31\u00a0minutes ago\n \n Description : Lemur manages TLS certificat...", "creation_timestamp": "2026-08-18T20:36:52.180015Z"} 2026-08-18T20:36:52.180015+00:00 https://vulnerability.circl.lu/sighting/75c68629-4aba-4ea1-96eb-7b5c3bc8e9a3/export 2026-08-20T19:10:02.601070+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "75c68629-4aba-4ea1-96eb-7b5c3bc8e9a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55166", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtezjmcxoj2t", "content": "\ud83d\udea8 CVE-2026-55166 \u2014 CVSS 9.9 CRITICAL\n\nLemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authori...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-55166\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T20:10:01.610357Z"} 2026-08-18T20:10:01.610357+00:00 https://vulnerability.circl.lu/sighting/8c3fb9c9-a437-45c9-9b11-b392266d0f60/export 2026-08-20T19:10:02.601132+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8c3fb9c9-a437-45c9-9b11-b392266d0f60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55166", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtez2cbezq2m", "content": "\ud83d\udd34 CVE-2026-55166 - Critical (9.9)\n\nLemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an AC...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55166/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-18T20:01:28.861058Z"} 2026-08-18T20:01:28.861058+00:00 https://vulnerability.circl.lu/sighting/ffecab7f-bd75-41f1-bfc8-037545d29d4a/export 2026-08-20T19:10:02.601194+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "ffecab7f-bd75-41f1-bfc8-037545d29d4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55166", "type": "published-proof-of-concept", "source": "https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v", "content": "", "creation_timestamp": "2026-06-26T00:35:02.489975Z"} 2026-06-26T00:35:02.489975+00:00