CVE-2026-70667 is a TOCTOU race condition in Netflix Lemur before version 1.9.3. The _validate_revocation_url function in lemur/certificates/verify.py initially checks the original CRL or OCSP URL but the subsequent HTTP request follows redirects without validating each Location header. This allows an attacker-controlled public URL to redirect to internal addresses such as loopback, RFC1918, link-local, or instance metadata endpoints. Separate DNS resolutions during validation and connection create a window for DNS rebinding attacks on both CRL and OCSP paths. An operator uploading a certificate via POST /api/1/certificates/upload can cause blind internal requests despite prior mitigations. The fix in 1.9.3 disables redirects and pins validated IP addresses while preserving the correct Host header.

An attacker able to control a public URL used in certificate revocation checks can exploit the TOCTOU race condition to induce Lemur to make blind HTTP requests to internal or sensitive network addresses. This could lead to information disclosure or other impacts related to internal network access. The CVSS score of 6.3 reflects a medium severity with low attack complexity and low privileges required, impacting confidentiality, integrity, and availability.

Upgrade Lemur to version 1.9.3 or later, where the vulnerability is fixed by disabling HTTP redirects during revocation URL checks and pinning validated IP addresses. No other mitigations are indicated or required beyond applying this official fix.