Netflix Lemur, a TLS certificate management tool, had an SSRF vulnerability (CWE-918) identified as CVE-2026-71303. Before version 1.9.3, the _validate_acme_url function enforced an allowlist only during authority creation, but the PUT /api/1/authorities/ endpoint did not apply this check when updating authority options. This allowed users with authority roles to set the acme_url to internal IP addresses or cloud instance metadata URLs (e.g., 169.254.169.254). Subsequent certificate issuance operations used this manipulated URL, causing the Lemur backend to make outbound requests to internal services, bypassing earlier mitigations for a related vulnerability (CVE-2026-55166). The vulnerability is resolved in version 1.9.3 by enforcing validation on acme_url updates.

An attacker with authority role privileges can exploit this SSRF vulnerability to cause the Lemur backend to make requests to internal services or cloud metadata endpoints. This can lead to exposure of sensitive internal information or cloud instance metadata, potentially aiding further attacks. The CVSS score of 7.7 reflects high severity with network attack vector, low complexity, and high confidentiality impact but no integrity or availability impact.

Upgrade to Netflix Lemur version 1.9.3 or later, where the acme_url is revalidated whenever authority options are updated, effectively fixing this SSRF vulnerability. There is no indication of alternative mitigations or temporary fixes. Patch status is confirmed by the vendor advisory stating the issue is fixed in 1.9.3.