CVE-2026-70666: Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder, authorizations, and finalize URLs chosen by that server. The Lemur ClientV2 followed those URLs without requiring their host to match the configured directory host, allowing JWS-signed requests to internal services or cloud metadata endpoints. The issue required an ACME authority and a user authorized for that authority, but did not require global administrator privileges. The fix revalidates updates and introduces PinnedClientNetwork to enforce a single allowed host for the complete ACME flow. This issue is fixed in version 1.9.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.9.3 - Configuration
Configure Lemur to use _PinnedClientNetwork to enforce a single allowed host for the complete ACME flow, so Server-controlled ACME directory/order/finalize URLs cannot direct the ACME client to other hosts.
Lemur ClientV2 _PinnedClientNetwork = enable/pin to a single allowed host for the complete ACME flow - Configuration
Ensure updates to acme_url via PUT /api/1/authorities/ require revalidation (the fix revalidates updates) to prevent setting acme_url to an attacker-controlled ACME server without revalidation.
Lemur ACME authority management acme_url update revalidation = revalidation required
Event History
Frequently Asked Questions
What level of access does an attacker need?
Exploitation requires an existing ACME authority and a user authorized for that authority. Global administrator privileges are not required, but an unauthenticated external attacker cannot trigger the issue from the information provided.
Which deployments are exposed?
Lemur versions prior to 1.9.3 are affected where an ACME authority exists and an authority-role member can update it through PUT /api/1/authorities/. The vulnerable update path allowed acme_url to be changed without revalidation.
What can exploitation cause?
The attacker can operate a malicious ACME server and return directory or order URLs pointing to internal services or cloud metadata endpoints. Lemur may follow those URLs and send JWS-signed requests to them, because the URL host was not required to match the configured ACME directory host.
What is the remediation and available mitigation?
Upgrade to Lemur 1.9.3, which revalidates ACME URL updates and pins the complete ACME flow to a single allowed host. If upgrading cannot happen immediately, restrict authority-role access and prevent untrusted users from changing ACME authority configuration.