CVE-2026-55162

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55162", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T15:13:28.165Z", "datePublished": "2026-08-18T18:52:25.801Z", "dateUpdated": "2026-08-19T15:15:42.749Z"}, "containers": {"cna": {"title": "Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95"}, {"name": "https://github.com/Netflix/lemur/commit/733714a2b00b2f72c3d460e440770e46a3ea9d6a", "tags": ["x_refsource_MISC"], "url": "https://github.com/Netflix/lemur/commit/733714a2b00b2f72c3d460e440770e46a3ea9d6a"}, {"name": "https://github.com/Netflix/lemur/releases/tag/v1.9.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Netflix/lemur/releases/tag/v1.9.2"}], "affected": [{"vendor": "Netflix", "product": "lemur", "versions": [{"version": "< 1.9.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T18:52:25.801Z"}, "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2."}], "source": {"advisory": "GHSA-54vg-pfh7-jq95", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T15:15:14.131468Z", "id": "CVE-2026-55162", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T15:15:42.749Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55162", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T15:15:14.131468Z"}}}], "references": [{"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T15:15:34.754Z"}}], "cna": {"title": "Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates", "source": {"advisory": "GHSA-54vg-pfh7-jq95", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Netflix", "product": "lemur", "versions": [{"status": "affected", "version": "< 1.9.2"}]}], "references": [{"url": "https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95", "name": "https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Netflix/lemur/commit/733714a2b00b2f72c3d460e440770e46a3ea9d6a", "name": "https://github.com/Netflix/lemur/commit/733714a2b00b2f72c3d460e440770e46a3ea9d6a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Netflix/lemur/releases/tag/v1.9.2", "name": "https://github.com/Netflix/lemur/releases/tag/v1.9.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T18:52:25.801Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55162", "state": "PUBLISHED", "dateUpdated": "2026-08-19T15:15:42.749Z", "dateReserved": "2026-06-16T15:13:28.165Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T18:52:25.801Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "lemur", "vendor": "Netflix", "versions": [{"status": "affected", "version": "< 1.9.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2."}, {"lang": "es", "value": "Lemur gestiona la creaci\u00f3n de certificados TLS. Antes de la 1.9.2, lemur/certificates/verify.py aceptaba URL de puntos de distribuci\u00f3n de CRL y de respondedores OCSP de extensiones de certificados cargados y las utilizaba en crl_verify y ocsp_verify sin una validaci\u00f3n de destino adecuada. Un operador autenticado podr\u00eda enviar un certificado a trav\u00e9s de POST /API/1/certificates/upload y hacer que verify_string alcanzara destinos de loopback, RFC1918, link-local o de metadatos de instancia, como 169.254.169.254. Las solicitudes podr\u00edan sondear servicios internos y crear efectos secundarios desde la posici\u00f3n de red del host Lemur. La ruta CRL tambi\u00e9n utilizaba una cach\u00e9 ilimitada, permitiendo que entradas controladas por el atacante persistieran y consumieran memoria. La soluci\u00f3n valida los destinos, admite listas blancas expl\u00edcitas de hosts de confianza y limita la cach\u00e9 CRL. Este problema se corrige en la versi\u00f3n 1.9.2."}], "id": "CVE-2026-55162", "lastModified": "2026-10-22T22:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55162", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T15:15:14.131468Z", "version": "2.0.3"}}]}, "published": "2026-08-18T19:16:58.217", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Netflix/lemur/commit/733714a2b00b2f72c3d460e440770e46a3ea9d6a"}, {"source": "security-advisories@github.com", "url": "https://github.com/Netflix/lemur/releases/tag/v1.9.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.9.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "lemur", "source": "cna", "vendor": "Netflix"}, "product": "lemur", "vendor": "netflix"}], "created": "2026-08-18T20:45:04.333992+00:00", "updated": "2026-08-18T20:45:04.516499+00:00", "vendors": ["netflix", "netflix$PRODUCT$lemur"]}