CVE-2026-71303

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3

Description An issue exists where the validate acme url function fails to enforce the ACME DIRECTORY HOST ALLOWLIST when updating authority options via the 'PUT /api/1/authorities/' endpoint. A user with an authority role can replace the stored acme url with an internal service or instance-metadata URL, such as 169.254.169.254. Subsequent issuance operations pass this value to ClientV2.get directory(), triggering an outbound request from the backend that can expose internal services or cloud metadata.

Recommendations Update to version 1.9.3.