https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 21:36:21 +0000 https://vulnerability.circl.lu/vuln/cve-2026-71303 <p><strong>Affected:</strong> Netflix lemur</p> <p>Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the stored acme_url with an internal service or instance-metadata URL such as 169.254.169.254. The next issuance operation loaded that value and passed it to ClientV2.get_directory, causing an outbound request from the Lemur backend. This bypassed the creation-time mitigation for CVE-2026-55166 and could expose internal services or cloud metadata. The fix revalidates acme_url whenever authority options are updated. This issue is fixed in version 1.9.3.</p> <p><strong>Affected:</strong> Netflix lemur</p> <p>Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the stored acme_url with an internal service or instance-metadata URL such as 169.254.169.254. The next issuance operation loaded that value and passed it to ClientV2.get_directory, causing an outbound request from the Lemur backend. This bypassed the creation-time mitigation for CVE-2026-55166 and could expose internal services or cloud metadata. The fix revalidates acme_url whenever authority options are updated. This issue is fixed in version 1.9.3.</p> https://vulnerability.circl.lu/vuln/cve-2026-71303 https://vulnerability.circl.lu/vuln/pysec-2026-3679 <p><strong>Affected:</strong> PyPI: lemur</p> <p>### Summary</p> <p>The fix for GHSA-v2wp-frmc-5q3v added `_validate_acme_url()` to reject `acme_url` values not in `ACME_DIRECTORY_HOST_ALLOWLIST`, but the validation is only called at **authority creation time** (POST). The authority **update** endpoint (`PUT /api/1/authorities/&lt;id&gt;`) accepts and stores arbitrary `options` -- including a modified `acme_url` -- without invoking the allowlist check. Any user with an authority role (granted by an admin to allow issuing certificates via that authority) can therefore overwrite the stored `acme_url` with an internal IP or IMDS endpoint. The next certificate issuance via that authority causes Lemur&#39;s backend to fetch the attacker-controlled URL, achieving SSRF.</p> <p>### Details</p> <p>**Where the fix lives (POST path -- protected):**</p> <p>`lemur/plugins/lemur_acme/plugin.py` lines 333-337 (ACMEIssuerPlugin.create_authority): ```python for option in plugin_options: if option.get(&#34;name&#34;) == &#34;certificate&#34;: acme_root = option.get(&#34;value&#34;) if option.get(&#34;name&#34;) == &#34;acme_url&#34;: _validate_acme_url(option.get(&#34;value&#34;, &#34;&#34;)) # allowlist enforced ```</p> <p>`_validate_acme_url` at line 35: ```python def _validate_acme_url(url): &#34;&#34;&#34;Reject acme_url values that are not in the configured allowlist.</p> <p>Called at authority creation time only -- existing authorities in the DB were already trusted when they were created and are not re-validated. &#34;&#34;&#34; allowed_hosts = current_app.config.get( &#34;ACME_DIRECTORY_HOST_ALLOWLIST&#34;,…</p> <p><strong>Affected:</strong> PyPI: lemur</p> <p>### Summary</p> <p>The fix for GHSA-v2wp-frmc-5q3v added `_validate_acme_url()` to reject `acme_url` values not in `ACME_DIRECTORY_HOST_ALLOWLIST`, but the validation is only called at **authority creation time** (POST). The authority **update** endpoint (`PUT /api/1/authorities/&lt;id&gt;`) accepts and stores arbitrary `options` -- including a modified `acme_url` -- without invoking the allowlist check. Any user with an authority role (granted by an admin to allow issuing certificates via that authority) can therefore overwrite the stored `acme_url` with an internal IP or IMDS endpoint. The next certificate issuance via that authority causes Lemur&#39;s backend to fetch the attacker-controlled URL, achieving SSRF.</p> <p>### Details</p> <p>**Where the fix lives (POST path -- protected):**</p> <p>`lemur/plugins/lemur_acme/plugin.py` lines 333-337 (ACMEIssuerPlugin.create_authority): ```python for option in plugin_options: if option.get(&#34;name&#34;) == &#34;certificate&#34;: acme_root = option.get(&#34;value&#34;) if option.get(&#34;name&#34;) == &#34;acme_url&#34;: _validate_acme_url(option.get(&#34;value&#34;, &#34;&#34;)) # allowlist enforced ```</p> <p>`_validate_acme_url` at line 35: ```python def _validate_acme_url(url): &#34;&#34;&#34;Reject acme_url values that are not in the configured allowlist.</p> <p>Called at authority creation time only -- existing authorities in the DB were already trusted when they were created and are not re-validated. &#34;&#34;&#34; allowed_hosts = current_app.config.get( &#34;ACME_DIRECTORY_HOST_ALLOWLIST&#34;,…</p> https://vulnerability.circl.lu/vuln/pysec-2026-3679