{"id":"CVE-2026-71303","title":"Lemur manages TLS certificate creation","summary":"Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying …","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwe":["CWE-918"],"vendor":"lemur","product":"lemur","affected":["lemur <= 1.9.2"],"patched":["lemur 1.9.3"],"published":"2026-08-18","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:02:26.047","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71303","references":[{"url":"https://github.com/Netflix/lemur/commit/edca0390f930344d65ff4ca37a669c2320e3dfad","label":"security-advisories@github.com"},{"url":"https://github.com/Netflix/lemur/releases/tag/v1.9.3","label":"security-advisories@github.com"},{"url":"https://github.com/Netflix/lemur/security/advisories/GHSA-v5rc-cpwc-cfpr","label":"security-advisories@github.com"},{"url":"https://github.com/Netflix/lemur/security/advisories/GHSA-v5rc-cpwc-cfpr","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-v5rc-cpwc-cfpr"}],"tags":["nvd","ghsa","pip"],"epss":0.00268,"epssPercentile":0.19211,"aliases":["GHSA-v5rc-cpwc-cfpr"],"ecosystem":"pip","ingestedAt":"2026-08-18T21:22:59.760Z","slug":"CVE-2026-71303","body":"## Overview\n\nLemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the stored acme_url with an internal service or instance-metadata URL such as 169.254.169.254. The next issuance operation loaded that value and passed it to ClientV2.get_directory, causing an outbound request from the Lemur backend. This bypassed the creation-time mitigation for CVE-2026-55166 and could expose internal services or cloud metadata. The fix revalidates acme_url whenever authority options are updated. This issue is fixed in version 1.9.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-71303)\n\nAffected packages:\n\n- `lemur <= 1.9.2`\n\nPatched in:\n\n- `lemur 1.9.3`\n\nSource: https://github.com/advisories/GHSA-v5rc-cpwc-cfpr","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}