CVE-2026-70667— Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)
Possible ATT&CK Techniques 2AI
T1071 · Application Layer Protocol T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-70667
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)
Source: CVE Program / CVE List V5
Vulnerability Description
Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, so a public attacker-controlled URL could redirect to loopback, RFC1918, link-local, or instance-metadata addresses. Validation and connection also performed separate DNS resolutions, creating a time-of-check time-of-use window for DNS rebinding on both CRL and OCSP paths. An operator uploading a certificate through POST /api/1/certificates/upload could therefore induce blind internal requests despite the earlier mitigation. The fix disables redirects and pins validated addresses while preserving the correct Host value. This issue is fixed in version 1.9.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-70667
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-70667
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-70667 (1)
Vendor Advisories for CVE-2026-70667 (1)
Vendor Pages for CVE-2026-70667 (1)
Same Patch Batch · Netflix · 2026-08-18 · 14 CVEs total
| CVE-2026-55166 | 9.9 CRITICAL | Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access |
| CVE-2026-48508 | 8.8 HIGH | Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission |
| CVE-2026-71308 | 8.1 HIGH | Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation |
| CVE-2026-71307 | 7.7 HIGH | Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP |
| CVE-2026-71303 | 7.7 HIGH | Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admi |
| CVE-2026-70666 | 7.4 HIGH | Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs |
| CVE-2026-71417 | 7.3 HIGH | Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate recor |
| CVE-2026-71317 | 6.5 MEDIUM | Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority |
| CVE-2026-55162 | 6.3 MEDIUM | Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and |
| CVE-2026-55163 | 6.3 MEDIUM | Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite |
| CVE-2026-55164 | 4.9 MEDIUM | Lemur: Plaintext password storage in Lemur user-update path |
| CVE-2026-55165 | 4.8 MEDIUM | Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap |
| CVE-2026-71322 | 4.3 MEDIUM | Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requ |
IV. Related Vulnerabilities
Same product: lemur
- CVE-2026-71417
Lemur: Any user can revoke arbitrary certificates at the CA - CVE-2026-71322
Lemur: Missing authorization check on POST /certificates/<id - CVE-2026-71317
Lemur: Sub-CA creation never checks `AuthorityPermission` on - CVE-2026-70666
Lemur: Server-Side Request Forgery via the ACME client follo - CVE-2026-71303
Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority u
Same vendor: Netflix
- CVE-2026-71417
Lemur: Any user can revoke arbitrary certificates at the CA - CVE-2026-71322
Lemur: Missing authorization check on POST /certificates/<id - CVE-2026-71317
Lemur: Sub-CA creation never checks `AuthorityPermission` on - CVE-2026-70666
Lemur: Server-Side Request Forgery via the ACME client follo - CVE-2026-71303
Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority u
Same weakness: CWE-367
- CVE-2026-16838
Vulnerabilities in IBM AIX and PowerVM VIOS - CVE-2026-73829
Non-atomic hash-credential dedup in mpp Tempo allows replay - CVE-2024-13942
Rockchip RK3588s Secure BootROM TOCTOU (time-of-check to tim - CVE-2026-16819
Vulnerabilities in IBM AIX and PowerVM VIOS - CVE-2026-53477
Dell Command Update 低于5.7.1版本本地权限提升漏洞
V. Comments for CVE-2026-70667
No comments yet