CVE-2026-71303High· 7.7▾ TwilightLemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.3%
Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the stored acme_url with an internal service or instance-metadata URL such as 169.254.169.254. The next issuance operation loaded that value and passed it to ClientV2.get_directory, causing an outbound request from the Lemur backend. This bypassed the creation-time mitigation for CVE-2026-55166 and could expose internal services or cloud metadata. The fix revalidates acme_url whenever authority options are updated. This issue is fixed in version 1.9.3.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
lemur <= 1.9.2Patched in:
lemur 1.9.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-70666High· 7.4Lemur manages TLS certificate creation
CVE-2026-70667Medium· 6.3Lemur manages TLS certificate creation
CVE-2026-71307High· 7.7Lemur manages TLS certificate creation
CVE-2026-71308High· 8.1Lemur manages TLS certificate creation
CVE-2026-71317Medium· 6.5Lemur manages TLS certificate creation
CVE-2026-71322Medium· 4.3Lemur manages TLS certificate creation