CVE-2026-71303: Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist
Lemur manages TLS certificate creation. Prior to 1.9.3, validateacmeurl enforced ACMEDIRECTORYHOSTALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the stored acmeurl with an internal service or instance-metadata URL such as 169.254.169.254. The next issuance operation loaded that value and passed it to ClientV2.getdirectory, causing an outbound request from the Lemur backend. This bypassed the creation-time mitigation for CVE-2026-55166 and could expose internal services or cloud metadata. The fix revalidates acmeurl whenever authority options are updated. This issue is fixed in version 1.9.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lemurto a version that resolves this vulnerability.Fixed in 1.9.3Patch CVE-2026-55166 - Configuration
Ensure Lemur revalidates `acme_url` (including enforcing `ACME_DIRECTORY_HOST_ALLOWLIST`) whenever `PUT /api/1/authorities/` updates authority options, not only at authority creation, to prevent non-admin bypass of the allowlist.
Lemur (authority acme_url validation) acme_url validation on authority options update = revalidate ACME_DIRECTORY_HOST_ALLOWLIST when authority options are updated
Event History
Frequently Asked Questions
Which users can trigger the outbound request?
Users who hold an authority role can exploit the issue; administrator privileges are not required. The vulnerable update path is the authority PUT endpoint, and exploitation does not require user interaction.
What conditions are needed for exploitation?
The issue affects deployments prior to version 1.9.3 where authority-role users can update authority options. It is specifically relevant when such users can change an authority's acme_url and a later certificate issuance operation occurs.
What is the available remediation?
Upgrade to Lemur 1.9.3, which revalidates acme_url whenever authority options are updated. If upgrading cannot happen immediately, the provided data does not specify an alternative mitigation.
How can we investigate possible exploitation?
Review authority updates for acme_url values pointing to internal addresses or metadata endpoints, such as 169.254.169.254. Also investigate subsequent issuance activity, because the backend request occurs when the updated authority is used for issuance.