Lemur, a TLS certificate management tool, had a critical vulnerability (CVE-2026-55166) in versions before 1.9.2. Authenticated users could exploit an SSRF flaw by influencing the ACME authority URL (acme_url) without effective server-side destination restrictions, causing the backend to make requests to internal or cloud metadata services. This could lead to exposure of cloud credentials accessible to the host. Additionally, an authorization weakness involving creator-equality allowed users to retain access to certificate private keys after ownership or role changes, with inadequate audit context to distinguish this access path. The combined SSRF and authorization issues could result in compromise of AWS IAM credentials and long-lived PKI private keys. The fix in version 1.9.2 introduces ACME_DIRECTORY_HOST_ALLOWLIST validation and enriches key export audit logs with creator and current owner information.

Successful exploitation could allow an authenticated attacker to perform server-side request forgery to access internal services or cloud instance metadata, potentially obtaining sensitive cloud credentials. The authorization flaw could permit unauthorized access to private certificate keys even after role or ownership changes, risking long-term compromise of PKI material. This could lead to full compromise of AWS IAM credentials and private keys managed by Lemur, severely impacting confidentiality and integrity of cloud and certificate infrastructure.

A patch is available and the issue is fixed in Lemur version 1.9.2. Users should upgrade to version 1.9.2 or later to remediate this vulnerability. The fix includes validation of ACME directory hosts via an allowlist and improved audit logging for private key exports. No additional mitigations are indicated by the vendor advisory.