---
id: CVE-2026-70666
title: Lemur manages TLS certificate creation
summary: >-
  Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role
  member could update acme_url through PUT /api/1/authorities/ without
  revalidation and direct setup_acme_client_no_retry to an attacker-controlled
  ACME server. ACME…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L'
cwe:
  - CWE-918
vendor: lemur
product: lemur
affected:
  - lemur <= 1.9.2
patched:
  - lemur 1.9.3
published: '2026-08-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:02:26.047'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-70666'
references:
  - url: >-
      https://github.com/Netflix/lemur/commit/6dcb19b6d6004e97796d6a0344b130b2ba57f050
    label: security-advisories@github.com
  - url: 'https://github.com/Netflix/lemur/releases/tag/v1.9.3'
    label: security-advisories@github.com
  - url: 'https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-xpmj-wjcp-6pww'
tags:
  - nvd
  - ghsa
  - pip
epss: 0.00216
epssPercentile: 0.10667
aliases:
  - GHSA-xpmj-wjcp-6pww
ecosystem: pip
ingestedAt: '2026-08-18T21:22:59.831Z'
---

## Overview

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and direct setup_acme_client_no_retry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder, authorizations, and finalize URLs chosen by that server. The Lemur ClientV2 followed those URLs without requiring their host to match the configured directory host, allowing JWS-signed requests to internal services or cloud metadata endpoints. The issue required an ACME authority and a user authorized for that authority, but did not require global administrator privileges. The fix revalidates updates and introduces _PinnedClientNetwork to enforce a single allowed host for the complete ACME flow. This issue is fixed in version 1.9.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-70666)

Affected packages:

- `lemur <= 1.9.2`

Patched in:

- `lemur 1.9.3`

Source: https://github.com/advisories/GHSA-xpmj-wjcp-6pww