CVE-2025-54799 is a vulnerability identified in the go-acme lego library, a widely used Let's Encrypt client and ACME protocol implementation written in Go. The affected versions are 4.25.1 and below. The core issue stems from the library's failure to enforce HTTPS when communicating with Certificate Authorities (CAs) during ACME protocol operations. While the ACME protocol mandates HTTPS for client-CA interactions to ensure confidentiality and integrity, this library version allows HTTP connections if the user configures an HTTP URL or if the CA endpoints are misconfigured. This flaw affects both the initial discovery URL and subsequent URLs returned by the CA in directory and order objects. As a result, sensitive information such as account identifiers and request details can be transmitted in cleartext over the network, exposing them to interception by network attackers. This compromises privacy but does not directly affect the integrity or availability of the system. The vulnerability was addressed in version 4.25.2 by enforcing HTTPS usage. The CVSS 4.0 score is 2.3 (low severity), reflecting the limited impact and the requirement for user interaction and high attack complexity. No known exploits are reported in the wild. The vulnerability relates to CWE-319 (Cleartext Transmission of Sensitive Information).

For European organizations, this vulnerability primarily threatens the confidentiality of sensitive ACME protocol communications when using the affected lego client versions. Organizations relying on automated certificate management with the go-acme lego library could inadvertently expose account and request identifiers if HTTP endpoints are used, either due to misconfiguration or malicious redirection. This exposure could facilitate network-level reconnaissance or targeted attacks on certificate management infrastructure. However, the impact is limited as the vulnerability does not allow direct compromise of certificate issuance or modification, nor does it affect certificate integrity or availability. The risk is higher in environments where network traffic is monitored or intercepted, such as public or untrusted networks. European organizations with strict data privacy regulations (e.g., GDPR) must consider the privacy implications of transmitting sensitive data unencrypted. The vulnerability is less critical for organizations that enforce HTTPS endpoints and have updated to patched versions. Overall, the threat is low but warrants attention in certificate management workflows.

1. Upgrade all instances of the go-acme lego library and CLI to version 4.25.2 or later, where HTTPS enforcement is implemented. 2. Audit and verify all configured ACME server URLs to ensure they use HTTPS exclusively, avoiding any HTTP endpoints. 3. Implement network-level controls such as TLS interception detection and strict transport security policies to prevent downgrade attacks or misconfigurations leading to HTTP usage. 4. Monitor network traffic for any unencrypted ACME protocol communications to detect potential exposure. 5. Educate developers and DevOps teams on the importance of secure ACME client configurations and the risks of using HTTP endpoints. 6. Where possible, restrict lego client usage to trusted internal networks or VPNs to reduce exposure to network attackers. 7. Incorporate automated testing in CI/CD pipelines to detect usage of vulnerable lego versions or insecure URLs.