CVE-2026-70666: Server-Side Request Forgery in Netflix Lemur ACME Authority Management

Netflix Lemur functions as an orchestration framework designed to manage and automate TLS certificates across complex enterprise environments. Its ACME integration plugin (lemur_acme) handles communication with Automated Certificate Management Environment providers like Let's Encrypt to validate ownership and issue certificates.

The attack surface exists in how Lemur handles internal authority administrative actions and parses ACME directory parameters. A vulnerability in both the validation logic and the networking client allows an authenticated authority-role user to hijack outbound requests. This creates an exploitation path targeting internal networks, microservices, and metadata endpoints.

The vulnerability consists of two distinct software defects that work in tandem. The first defect involves an authentication-by-role privilege escalation within the authority update paths. During authority creation, Lemur enforces the ACME_DIRECTORY_HOST_ALLOWLIST filter. However, the update endpoints PUT /api/1/authorities/{id} and PUT /api/1/authorities/{id}/options failed to re-validate modified configurations, permitting arbitrary ACME directory URL changes.

The second defect is an unvalidated endpoint trust issue. RFC 8555 specifies that an ACME client must first fetch a directory resource to obtain active endpoint links (e.g., newOrder, newNonce). The standard Python acme dependency class ClientNetwork retrieves and connects to these links automatically. Because Lemur did not verify that these dynamically returned hostnames matched the original trusted ACME directory domain, a malicious directory server could redirect outbound Lemur API calls to internal system targets.

To address the bypass, the patch implements strict hostname validation within the update pathways inside lemur/authorities/service.py and creates a custom client class to restrict HTTP network traffic.

The updated validation routine extracts and verifies the hostname of any updated ACME URL:

# lemur/authorities/service.py
def _validate_acme_url(url: str) -> None:
    allowed_hosts = current_app.config.get(
        'ACME_DIRECTORY_HOST_ALLOWLIST',
        {
            'acme-v02.api.letsencrypt.org',
            'acme-staging-v02.api.letsencrypt.org',
            'dv.acme-v02.api.pki.goog',
        },
    )
    parsed = urlparse(url)
    if parsed.scheme != 'https' or parsed.hostname not in allowed_hosts:
        raise InvalidConfiguration(
            f'acme_url host not in ACME_DIRECTORY_HOST_ALLOWLIST: {parsed.hostname}'
        )

Additionally, the patch replaces the default networking component with a pinned-hostname implementation to prevent redirect attacks:

# lemur/plugins/lemur_acme/acme_handlers.py
class _PinnedClientNetwork(ClientNetwork):
    def __init__(self, *args, pinned_hostname: str, **kwargs):
        super().__init__(*args, **kwargs)
        self._pinned_hostname = pinned_hostname
 
    def _send_request(self, method: str, url: str, *args, **kwargs) -> requests.Response:
        parsed = urlparse(url)
        # Enforce hostname equality for all dynamic requests
        if parsed.hostname != self._pinned_hostname:
            raise InvalidConfiguration(
                f'ACME client attempted request to disallowed host {parsed.hostname!r}; ' 
                f'expected {self._pinned_hostname!r}'
            )
        return super()._send_request(method, url, *args, **kwargs)

Exploiting this flaw requires the attacker to possess credentials with sufficient authorization to modify a Lemur authority configuration. The attacker hosts a malicious server configured to return an ACME-compatible JSON payload that substitutes internal network resources for normal ACME protocol endpoints.

Once the rogue server is online, the attacker targets the authority update endpoint using a JSON payload containing the rogue acme_url. Because the validation routines are missing from the update path, the backend database stores the modified configuration directly without error.

When a certificate generation process is subsequently initialized, Lemur queries the rogue ACME server directory. The rogue server sends a response that maps standard paths like newOrder to internal targets such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. The Lemur client processes this response and immediately transmits JWS-signed requests to the internal cloud metadata service, exposing IAM credentials to the attacker through system responses or error outputs.

The security impact of CVE-2026-70666 is significant due to the critical infrastructure role Lemur serves. By pivoting through the trusted Lemur server, an attacker bypasses perimeter defenses, firewalls, and network access control lists. This provides direct network access to otherwise isolated management plane APIs and local container network environments.

In environments deployed on Amazon Web Services (AWS), Google Cloud Platform (GCP), or Microsoft Azure, accessing the instance metadata service allows the attacker to extract short-term cloud provider credentials. If the instance runs with overly permissive IAM roles, the attacker can leverage these credentials to escalate privileges across the cloud account.

Furthermore, because the SSRF payload transmits JWS-signed JSON POST requests, it can be used to interact with raw key-value stores, database endpoints, or orchestration systems (such as Kubernetes Kubelet APIs) that accept unauthenticated or poorly authenticated JSON inputs over local interfaces.

Remediation requires upgrading Netflix Lemur instances to version 1.9.3 or higher. The update fixes the flaw by validating configurations during updates and restricting the network client to the pinned hostname of the ACME directory.

Until a patch is applied, administrators should deploy egress firewall filters on Lemur hosts. These filters must restrict outgoing HTTP/HTTPS traffic exclusively to recognized, public ACME endpoints. Additionally, cloud metadata service protections should be enforced by configuring IMDSv2 with a strict hop limit of 1.

Administrators can identify historical exploitation attempts by querying their databases for unauthorized values in the authority option configurations. The following query helps identify non-standard ACME URLs stored in the authority table:

SELECT id, name, options FROM authority WHERE options LIKE '%acme_url%';