CVE-2026-55162: CWE-918: Server-Side Request Forgery (SSRF) in Netflix lemur
Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2.
AI Analysis
Technical Summary
Lemur's certificate verification process in versions before 1.9.2 accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions without proper destination validation. An authenticated operator could exploit this by submitting certificates with URLs pointing to internal network addresses such as loopback, RFC1918, link-local, or instance metadata IPs (e.g., 169.254.169.254). This leads to SSRF, allowing the Lemur host to make unintended HTTP requests internally. The CRL cache was also unbounded, enabling attacker-controlled entries to persist and consume memory resources. The vulnerability is addressed in version 1.9.2 by validating destination URLs, implementing trusted-host allowlists, and bounding the CRL cache.
Potential Impact
An authenticated user can exploit this vulnerability to perform SSRF attacks, causing the Lemur server to make HTTP requests to internal or restricted network resources. This can lead to information disclosure or unintended side effects within the internal network environment. The unbounded CRL cache can also lead to increased memory usage, potentially impacting service stability.
Mitigation Recommendations
Upgrade Lemur to version 1.9.2 or later, where this vulnerability is fixed by validating destination URLs, enforcing trusted-host allowlists, and bounding the CRL cache. Since a patch is available, applying the official fix is the recommended remediation.
CVE-2026-55162: CWE-918: Server-Side Request Forgery (SSRF) in Netflix lemur
Description
Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2.
CVSS v3.1
Score 6.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Lemur's certificate verification process in versions before 1.9.2 accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions without proper destination validation. An authenticated operator could exploit this by submitting certificates with URLs pointing to internal network addresses such as loopback, RFC1918, link-local, or instance metadata IPs (e.g., 169.254.169.254). This leads to SSRF, allowing the Lemur host to make unintended HTTP requests internally. The CRL cache was also unbounded, enabling attacker-controlled entries to persist and consume memory resources. The vulnerability is addressed in version 1.9.2 by validating destination URLs, implementing trusted-host allowlists, and bounding the CRL cache.
Potential Impact
An authenticated user can exploit this vulnerability to perform SSRF attacks, causing the Lemur server to make HTTP requests to internal or restricted network resources. This can lead to information disclosure or unintended side effects within the internal network environment. The unbounded CRL cache can also lead to increased memory usage, potentially impacting service stability.
Mitigation Recommendations
Upgrade Lemur to version 1.9.2 or later, where this vulnerability is fixed by validating destination URLs, enforcing trusted-host allowlists, and bounding the CRL cache. Since a patch is available, applying the official fix is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-54vg-pfh7-jq95
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-55162"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a3ef7e527e9c79719032b50
Added to database: 06/26/2026, 22:06:29 UTC
Last enriched: 08/19/2026, 11:15:25 UTC
Last updated: 09/13/2026, 08:16:27 UTC
Views: 105
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.