CVE-2026-55162

Name of the Vulnerable Software and Affected Versions Lemur (affected versions not specified)

Description An authenticated user with the operator role can induce the server to make unauthorized outbound requests to internal network resources. This occurs because the software extracts CRL Distribution Point and OCSP responder URLs from uploaded certificates and issues requests to them without validating the destination or restricting the scheme. This can be exploited via the POST /api/1/certificates/upload endpoint, as well as other paths where verify string is invoked.

Technical details include:

An attacker can use this to probe internal network topology, access instance metadata endpoints (such as http://169.254.169.254/ on EC2), or perform cache poisoning by pinning malicious CRLs into the crl cache dictionary.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Implement an explicit allow-list of trusted CRL and OCSP hostnames in the configuration using LEMUR TRUSTED CRL HOSTS and LEMUR TRUSTED OCSP HOSTS and reject any requests to destinations outside this list.

Use an SSRF-safe HTTP client wrapper that resolves destinations and rejects RFC1918, link-local, loopback, and IPv6 ULA addresses before connecting.

Restrict the use of the crl cache dictionary by applying bounds to prevent persistent cache poisoning.

Restrict access to the POST /api/1/certificates/upload endpoint to only highly trusted users to minimize the risk of exploitation.