CVE-2026-70667 (GCVE-0-2026-70667)
Vulnerability from cvelistv5 – Published: 2026-08-18 18:55 – Updated: 2026-08-19 15:16
VLAI
EPSS
VEX
Title
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)
Summary
Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, so a public attacker-controlled URL could redirect to loopback, RFC1918, link-local, or instance-metadata addresses. Validation and connection also performed separate DNS resolutions, creating a time-of-check time-of-use window for DNS rebinding on both CRL and OCSP paths. An operator uploading a certificate through POST /api/1/certificates/upload could therefore induce blind internal requests despite the earlier mitigation. The fix disables redirects and pins validated addresses while preserving the correct Host value. This issue is fixed in version 1.9.3.
Severity
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 15:16 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Netflix/lemur/security/advisor… | x_refsource_CONFIRM |
| https://github.com/Netflix/lemur/commit/ed504a830… | x_refsource_MISC |
| https://github.com/Netflix/lemur/releases/tag/v1.9.3 | x_refsource_MISC |
| https://github.com/Netflix/lemur/security/advisor… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70667",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T15:16:23.054190Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T15:16:47.910Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "lemur",
"vendor": "Netflix",
"versions": [
{
"status": "affected",
"version": "\u003c 1.9.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, so a public attacker-controlled URL could redirect to loopback, RFC1918, link-local, or instance-metadata addresses. Validation and connection also performed separate DNS resolutions, creating a time-of-check time-of-use window for DNS rebinding on both CRL and OCSP paths. An operator uploading a certificate through POST /api/1/certificates/upload could therefore induce blind internal requests despite the earlier mitigation. The fix disables redirects and pins validated addresses while preserving the correct Host value. This issue is fixed in version 1.9.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:55:44.317Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f"
},
{
"name": "https://github.com/Netflix/lemur/commit/ed504a830f38a83825b1570302e9f38d6553938a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Netflix/lemur/commit/ed504a830f38a83825b1570302e9f38d6553938a"
},
{
"name": "https://github.com/Netflix/lemur/releases/tag/v1.9.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Netflix/lemur/releases/tag/v1.9.3"
}
],
"source": {
"advisory": "GHSA-f3qq-49m6-rw8f",
"discovery": "UNKNOWN"
},
"title": "Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-70667",
"datePublished": "2026-08-18T18:55:44.317Z",
"dateReserved": "2026-08-04T21:48:08.613Z",
"dateUpdated": "2026-08-19T15:16:47.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-70667",
"date": "2026-10-15",
"epss": "0.00179",
"percentile": "0.06985"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "lemur",
"vendor": "Netflix",
"versions": [
{
"status": "affected",
"version": "\u003c 1.9.3"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, so a public attacker-controlled URL could redirect to loopback, RFC1918, link-local, or instance-metadata addresses. Validation and connection also performed separate DNS resolutions, creating a time-of-check time-of-use window for DNS rebinding on both CRL and OCSP paths. An operator uploading a certificate through POST /api/1/certificates/upload could therefore induce blind internal requests despite the earlier mitigation. The fix disables redirects and pins validated addresses while preserving the correct Host value. This issue is fixed in version 1.9.3."
}
],
"id": "CVE-2026-70667",
"lastModified": "2026-09-08T21:02:26.047",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-70667",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T15:16:23.054190Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-18T19:17:03.293",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/Netflix/lemur/commit/ed504a830f38a83825b1570302e9f38d6553938a"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/Netflix/lemur/releases/tag/v1.9.3"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-367"
},
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
}
}
}
FKIE_CVE-2026-70667
Vulnerability from fkie_nvd - Published: 2026-08-18 19:17 - Updated: 2026-09-08 21:02
Severity
Summary
Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, so a public attacker-controlled URL could redirect to loopback, RFC1918, link-local, or instance-metadata addresses. Validation and connection also performed separate DNS resolutions, creating a time-of-check time-of-use window for DNS rebinding on both CRL and OCSP paths. An operator uploading a certificate through POST /api/1/certificates/upload could therefore induce blind internal requests despite the earlier mitigation. The fix disables redirects and pins validated addresses while preserving the correct Host value. This issue is fixed in version 1.9.3.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "lemur",
"vendor": "Netflix",
"versions": [
{
"status": "affected",
"version": "\u003c 1.9.3"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, so a public attacker-controlled URL could redirect to loopback, RFC1918, link-local, or instance-metadata addresses. Validation and connection also performed separate DNS resolutions, creating a time-of-check time-of-use window for DNS rebinding on both CRL and OCSP paths. An operator uploading a certificate through POST /api/1/certificates/upload could therefore induce blind internal requests despite the earlier mitigation. The fix disables redirects and pins validated addresses while preserving the correct Host value. This issue is fixed in version 1.9.3."
}
],
"id": "CVE-2026-70667",
"lastModified": "2026-09-08T21:02:26.047",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-70667",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T15:16:23.054190Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-18T19:17:03.293",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/Netflix/lemur/commit/ed504a830f38a83825b1570302e9f38d6553938a"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/Netflix/lemur/releases/tag/v1.9.3"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-367"
},
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-F3QQ-49M6-RW8F
Vulnerability from github – Published: 2026-08-18 20:51 – Updated: 2026-08-18 20:51
VLAI
Summary
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)
Details
Summary
The SSRF mitigation added for GHSA-54vg-pfh7-jq95 (_validate_revocation_url() in lemur
/certificates/verify.py) can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations (RFC1918, loopback, link-local 169.254.169.254) during verification.
Affected version
Tested against main (the commit that introduced _validate_revocation_url). The 1.9.2 release predates that guard and is vulnerable to the original SSRF (GHSA-54vg-pfh7-jq95) directly; this bypass applies to the unreleased mitigation in main. Please map the affected range to whichever release will first contain _validate_revocation_url.
Bypass 1 — HTTP redirect (deterministic)
The guard validates only the URL in the certificate; the CRL fetch then follows redirects without re-validating the target:
# lemur/certificates/verify.py:174
response = requests.get(point, timeout=(3.05, 6))
The attacker hosts the CRL URL on a public host they control (passes the guard); that host returns 302 Location: http://169.254.169.254/.... requests follows it to the internal target the guard never inspected.
Bypass 2 — DNS rebinding / TOCTOU (probabilistic)
The guard resolves once during validation; the fetch re-resolves independently:
# lemur/certificates/verify.py:51
addr = ipaddress.ip_address(socket.gethostbyname(hostname))
A low-TTL attacker name that answers a public IP at check time and an internal IP at fetch time passes the guard but is fetched internally. Same gap affects the OCSP path (openssl ocsp -url <url>, verify.py:90-99).
Relationship to GHSA-54vg-pfh7-jq95
Incomplete-fix of that mitigation, not a duplicate. Bypass 1 is not mentioned there; bypass 2 is the rebinding gap that advisory's remediation text anticipated ("pins the resolved IP") but the code does not implement.
Affected endpoint
POST /api/1/certificates/upload (operator role) → verify_string → crl_verify / ocsp_verify. Triggered when verification runs (e.g. the check_revocation task).
PoC
- Generate a cert with
crlDistributionPoints = URI:http://attacker.example/crl. - That host returns
302 Location: http://169.254.169.254/latest/meta-data/...(bypass 1), or use a low-TTL rebinding name (bypass 2). - Upload via
POST /api/1/certificates/uploadas an operator user. - Trigger
lemur certificate check_revocation. - Observe the request reach the internal address (
tcpdump -nni any host 169.254.169.254).
Impact
Blind SSRF from the Lemur host: reach internal services and instance metadata (169.254.169.254 without IMDSv2). Response is parsed as a CRL and discarded — reachability/side-effects, not response exfiltration.
Remediation
allow_redirects=Falseon CRL fetches (or re-validate every redirect hop).- Resolve once, pin the IP, connect to the pinned address; route the OCSP URL through the same check.
- Reject names with any internal A/AAAA record.
Severity
6.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "lemur"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-70667"
],
"database_specific": {
"cwe_ids": [
"CWE-367",
"CWE-918"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-18T20:51:12Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\nThe SSRF mitigation added for GHSA-54vg-pfh7-jq95 (`_validate_revocation_url()` in `lemur\n/certificates/verify.py`) can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations (RFC1918, loopback, link-local 169.254.169.254) during verification.\n\n## Affected version\nTested against `main` (the commit that introduced `_validate_revocation_url`). The 1.9.2 release predates that guard and is vulnerable to the original SSRF (GHSA-54vg-pfh7-jq95) directly; this bypass applies to the unreleased mitigation in `main`. Please map the affected range to whichever release will first contain `_validate_revocation_url`.\n\n## Bypass 1 \u2014 HTTP redirect (deterministic)\nThe guard validates only the URL in the certificate; the CRL fetch then follows redirects without re-validating the target:\n```python\n# lemur/certificates/verify.py:174\nresponse = requests.get(point, timeout=(3.05, 6)) \n```\nThe attacker hosts the CRL URL on a public host they control (passes the guard); that host returns `302 Location: http://169.254.169.254/...`. `requests` follows it to the internal target the guard never inspected.\n\n## Bypass 2 \u2014 DNS rebinding / TOCTOU (probabilistic)\nThe guard resolves once during validation; the fetch re-resolves independently:\n```python\n# lemur/certificates/verify.py:51\naddr = ipaddress.ip_address(socket.gethostbyname(hostname))\n```\n\nA low-TTL attacker name that answers a public IP at check time and an internal IP at fetch time passes the guard but is fetched internally. Same gap affects the OCSP path (`openssl ocsp -url \u003curl\u003e`, verify.py:90-99).\n\n## Relationship to GHSA-54vg-pfh7-jq95\nIncomplete-fix of that mitigation, not a duplicate. Bypass 1 is not mentioned there; bypass 2 is the rebinding gap that advisory\u0027s remediation text anticipated (\"pins the resolved IP\") but the code does not implement.\n\n## Affected endpoint\n`POST /api/1/certificates/upload` (operator role) \u2192 verify_string \u2192 crl_verify / ocsp_verify. Triggered when verification runs (e.g. the check_revocation task).\n\n## PoC\n1. Generate a cert with `crlDistributionPoints = URI:http://attacker.example/crl`.\n2. That host returns `302 Location: http://169.254.169.254/latest/meta-data/...` (bypass 1), or use a low-TTL rebinding name (bypass 2).\n3. Upload via `POST /api/1/certificates/upload` as an operator user.\n4. Trigger `lemur certificate check_revocation`.\n5. Observe the request reach the internal address (`tcpdump -nni any host 169.254.169.254`).\n\n\u003cimg width=\"1140\" height=\"277\" alt=\"poc-1\" src=\"https://github.com/user-attachments/assets/f27b9584-b33a-4b9c-b812-8c60302e1892\" /\u003e\n\n## Impact\nBlind SSRF from the Lemur host: reach internal services and instance metadata (169.254.169.254 without IMDSv2). Response is parsed as a CRL and discarded \u2014 reachability/side-effects, not response exfiltration.\n\n## Remediation\n- `allow_redirects=False` on CRL fetches (or re-validate every redirect hop).\n- Resolve once, pin the IP, connect to the pinned address; route the OCSP URL through the same check.\n- Reject names with any internal A/AAAA record.",
"id": "GHSA-f3qq-49m6-rw8f",
"modified": "2026-08-18T20:51:13Z",
"published": "2026-08-18T20:51:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f"
},
{
"type": "WEB",
"url": "https://github.com/Netflix/lemur/commit/ed504a830f38a83825b1570302e9f38d6553938a"
},
{
"type": "PACKAGE",
"url": "https://github.com/Netflix/lemur"
},
{
"type": "WEB",
"url": "https://github.com/Netflix/lemur/releases/tag/v1.9.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)"
}
PYSEC-2026-3676
Vulnerability from pysec - Published: 2026-08-19 11:56 - Updated: 2026-08-19 12:16
VLAI
Details
Summary
The SSRF mitigation added for GHSA-54vg-pfh7-jq95 (_validate_revocation_url() in lemur
/certificates/verify.py) can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations (RFC1918, loopback, link-local 169.254.169.254) during verification.
Affected version
Tested against main (the commit that introduced _validate_revocation_url). The 1.9.2 release predates that guard and is vulnerable to the original SSRF (GHSA-54vg-pfh7-jq95) directly; this bypass applies to the unreleased mitigation in main. Please map the affected range to whichever release will first contain _validate_revocation_url.
Bypass 1 — HTTP redirect (deterministic)
The guard validates only the URL in the certificate; the CRL fetch then follows redirects without re-validating the target:
# lemur/certificates/verify.py:174
response = requests.get(point, timeout=(3.05, 6))
The attacker hosts the CRL URL on a public host they control (passes the guard); that host returns 302 Location: http://169.254.169.254/.... requests follows it to the internal target the guard never inspected.
Bypass 2 — DNS rebinding / TOCTOU (probabilistic)
The guard resolves once during validation; the fetch re-resolves independently:
# lemur/certificates/verify.py:51
addr = ipaddress.ip_address(socket.gethostbyname(hostname))
A low-TTL attacker name that answers a public IP at check time and an internal IP at fetch time passes the guard but is fetched internally. Same gap affects the OCSP path (openssl ocsp -url <url>, verify.py:90-99).
Relationship to GHSA-54vg-pfh7-jq95
Incomplete-fix of that mitigation, not a duplicate. Bypass 1 is not mentioned there; bypass 2 is the rebinding gap that advisory's remediation text anticipated ("pins the resolved IP") but the code does not implement.
Affected endpoint
POST /api/1/certificates/upload (operator role) → verify_string → crl_verify / ocsp_verify. Triggered when verification runs (e.g. the check_revocation task).
PoC
- Generate a cert with
crlDistributionPoints = URI:http://attacker.example/crl. - That host returns
302 Location: http://169.254.169.254/latest/meta-data/...(bypass 1), or use a low-TTL rebinding name (bypass 2). - Upload via
POST /api/1/certificates/uploadas an operator user. - Trigger
lemur certificate check_revocation. - Observe the request reach the internal address (
tcpdump -nni any host 169.254.169.254).
Impact
Blind SSRF from the Lemur host: reach internal services and instance metadata (169.254.169.254 without IMDSv2). Response is parsed as a CRL and discarded — reachability/side-effects, not response exfiltration.
Remediation
allow_redirects=Falseon CRL fetches (or re-validate every redirect hop).- Resolve once, pin the IP, connect to the pinned address; route the OCSP URL through the same check.
- Reject names with any internal A/AAAA record.
Severity
6.3 (Medium)
Impacted products
| Name | purl | lemur | pkg:pypi/lemur |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "lemur",
"purl": "pkg:pypi/lemur"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.11.0",
"0.2.1",
"0.8.0",
"0.8.1",
"0.9.0",
"1.0.0",
"1.1.0",
"1.2.0",
"1.3.1",
"1.3.2",
"1.4.0",
"1.5.0",
"1.6.0",
"1.7.0",
"1.8.0",
"1.8.1",
"1.8.2",
"1.9.0",
"1.9.1",
"1.9.2"
]
}
],
"aliases": [
"CVE-2026-70667",
"GHSA-f3qq-49m6-rw8f"
],
"details": "## Summary\nThe SSRF mitigation added for GHSA-54vg-pfh7-jq95 (`_validate_revocation_url()` in `lemur\n/certificates/verify.py`) can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations (RFC1918, loopback, link-local 169.254.169.254) during verification.\n\n## Affected version\nTested against `main` (the commit that introduced `_validate_revocation_url`). The 1.9.2 release predates that guard and is vulnerable to the original SSRF (GHSA-54vg-pfh7-jq95) directly; this bypass applies to the unreleased mitigation in `main`. Please map the affected range to whichever release will first contain `_validate_revocation_url`.\n\n## Bypass 1 \u2014 HTTP redirect (deterministic)\nThe guard validates only the URL in the certificate; the CRL fetch then follows redirects without re-validating the target:\n```python\n# lemur/certificates/verify.py:174\nresponse = requests.get(point, timeout=(3.05, 6)) \n```\nThe attacker hosts the CRL URL on a public host they control (passes the guard); that host returns `302 Location: http://169.254.169.254/...`. `requests` follows it to the internal target the guard never inspected.\n\n## Bypass 2 \u2014 DNS rebinding / TOCTOU (probabilistic)\nThe guard resolves once during validation; the fetch re-resolves independently:\n```python\n# lemur/certificates/verify.py:51\naddr = ipaddress.ip_address(socket.gethostbyname(hostname))\n```\n\nA low-TTL attacker name that answers a public IP at check time and an internal IP at fetch time passes the guard but is fetched internally. Same gap affects the OCSP path (`openssl ocsp -url \u003curl\u003e`, verify.py:90-99).\n\n## Relationship to GHSA-54vg-pfh7-jq95\nIncomplete-fix of that mitigation, not a duplicate. Bypass 1 is not mentioned there; bypass 2 is the rebinding gap that advisory\u0027s remediation text anticipated (\"pins the resolved IP\") but the code does not implement.\n\n## Affected endpoint\n`POST /api/1/certificates/upload` (operator role) \u2192 verify_string \u2192 crl_verify / ocsp_verify. Triggered when verification runs (e.g. the check_revocation task).\n\n## PoC\n1. Generate a cert with `crlDistributionPoints = URI:http://attacker.example/crl`.\n2. That host returns `302 Location: http://169.254.169.254/latest/meta-data/...` (bypass 1), or use a low-TTL rebinding name (bypass 2).\n3. Upload via `POST /api/1/certificates/upload` as an operator user.\n4. Trigger `lemur certificate check_revocation`.\n5. Observe the request reach the internal address (`tcpdump -nni any host 169.254.169.254`).\n\n\u003cimg width=\"1140\" height=\"277\" alt=\"poc-1\" src=\"https://github.com/user-attachments/assets/f27b9584-b33a-4b9c-b812-8c60302e1892\" /\u003e\n\n## Impact\nBlind SSRF from the Lemur host: reach internal services and instance metadata (169.254.169.254 without IMDSv2). Response is parsed as a CRL and discarded \u2014 reachability/side-effects, not response exfiltration.\n\n## Remediation\n- `allow_redirects=False` on CRL fetches (or re-validate every redirect hop).\n- Resolve once, pin the IP, connect to the pinned address; route the OCSP URL through the same check.\n- Reject names with any internal A/AAAA record.",
"id": "PYSEC-2026-3676",
"modified": "2026-08-19T12:16:27.451309Z",
"published": "2026-08-19T11:56:28.331384Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f"
},
{
"type": "WEB",
"url": "https://github.com/Netflix/lemur/commit/ed504a830f38a83825b1570302e9f38d6553938a"
},
{
"type": "PACKAGE",
"url": "https://github.com/Netflix/lemur"
},
{
"type": "WEB",
"url": "https://github.com/Netflix/lemur/releases/tag/v1.9.3"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/lemur"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-f3qq-49m6-rw8f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70667"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.