CVE-2026-70667— Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)
Possible ATT&CK Techniques 2AI
T1071 · Application Layer Protocol T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-70667
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)
Source: CVE Program / CVE List V5
Vulnerability Description
Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, so a public attacker-controlled URL could redirect to loopback, RFC1918, link-local, or instance-metadata addresses. Validation and connection also performed separate DNS resolutions, creating a time-of-check time-of-use window for DNS rebinding on both CRL and OCSP paths. An operator uploading a certificate through POST /api/1/certificates/upload could therefore induce blind internal requests despite the earlier mitigation. The fix disables redirects and pins validated addresses while preserving the correct Host value. This issue is fixed in version 1.9.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5
Vulnerability Title
Netflix Lemur 竞争条件问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Netflix lemur是美国Netflix公司开源的一个证书管理工具。 Netflix Lemur 1.9.3之前版本存在安全漏洞，该漏洞源于 Lemur/certificates/verify.py 中的 _validate_revocation_url 函数验证原始CRL或OCSP URL时未充分检查后续请求的HTTP重定向目标，导致可被利用进行DNS重绑定和TOCTOU竞争条件攻击，攻击者通过POST /api/1/certificates/upload上传证书可触发服务端请求伪造，产生盲内部请
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-70667
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-70667
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-70667 (1)
Vendor Advisories for CVE-2026-70667 (1)
Vendor Pages for CVE-2026-70667 (1)
Same Patch Batch · Netflix · 2026-08-18 · 14 CVEs total
| CVE-2026-55166 | 9.9 CRITICAL | Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access |
| CVE-2026-48508 | 8.8 HIGH | Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission |
| CVE-2026-71308 | 8.1 HIGH | Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation |
| CVE-2026-71307 | 7.7 HIGH | Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP |
| CVE-2026-71303 | 7.7 HIGH | Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admi |
| CVE-2026-70666 | 7.4 HIGH | Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs |
| CVE-2026-71417 | 7.3 HIGH | Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate recor |
| CVE-2026-71317 | 6.5 MEDIUM | Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority |
| CVE-2026-55162 | 6.3 MEDIUM | Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and |
| CVE-2026-55163 | 6.3 MEDIUM | Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite |
| CVE-2026-55164 | 4.9 MEDIUM | Lemur: Plaintext password storage in Lemur user-update path |
| CVE-2026-55165 | 4.8 MEDIUM | Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap |
| CVE-2026-71322 | 4.3 MEDIUM | Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requ |
IV. Related Vulnerabilities
Same product: lemur
- CVE-2026-71417
Lemur: Any user can revoke arbitrary certificates at the CA - CVE-2026-71322
Lemur: Missing authorization check on POST /certificates/<id - CVE-2026-71317
Lemur: Sub-CA creation never checks `AuthorityPermission` on - CVE-2026-70666
Lemur: Server-Side Request Forgery via the ACME client follo - CVE-2026-71303
Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority u
Same vendor: Netflix
- CVE-2026-71417
Lemur: Any user can revoke arbitrary certificates at the CA - CVE-2026-71322
Lemur: Missing authorization check on POST /certificates/<id - CVE-2026-71317
Lemur: Sub-CA creation never checks `AuthorityPermission` on - CVE-2026-70666
Lemur: Server-Side Request Forgery via the ACME client follo - CVE-2026-71303
Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority u
Same weakness: CWE-367
V. Comments for CVE-2026-70667
No comments yet