CVE-2026-55166

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.0

Description Lemur is a TLS certificate management service that contains a critical authorization break resulting from a chain of three issues. First, the service auto-provisions new SSO identities as active without administrative approval. Second, the ACME authority-creation endpoint is susceptible to Server-Side Request Forgery (SSRF), where it fetches an attacker-supplied acme url without validation. This allows an attacker to reach the EC2 Instance Metadata Service (IMDS) at 169.254.169.254 and exfiltrate AWS STS credentials, including the AccessKeyId, SecretAccessKey, and Token of the lemur worker role. Third, an Insecure Direct Object Reference (IDOR) exists in the certificate key-fetch endpoint; the system grants the original creator unconditional access to the private key even after ownership has been transferred to another user or team. This allows an attacker to maintain permanent access to TLS private keys and impersonate authenticated principals in mTLS deployments.

Recommendations Implement a strict allowlist for the acme url parameter in acme handlers.py to reject any host not explicitly permitted and block access to private IP ranges (e.g., 169.254.0.0/16, 127.0.0.0/8). Remove the creator-based access branch in certificates/views.py and replace it with a mandatory RBAC check against the current certificate owner. Modify auth/views.py to set new SSO identities to active=False by default, requiring administrative approval or an email-domain allowlist for activation. Implement detailed audit logging for the /certificates/{id}/key endpoint that records the creator id, current owner, and the identity of the user fetching the key.