https://vulnerability.circl.lu/sightings/feed 2026-09-14T20:35:42.425116+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/cba82d10-e2e1-4059-8a13-7667cf855ecd/export 2026-09-14T20:35:42.455725+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "cba82d10-e2e1-4059-8a13-7667cf855ecd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-70669", "type": "seen", "source": "https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10", "content": "", "creation_timestamp": "2026-08-19T17:16:31.896808Z"} 2026-08-19T17:16:31.896808+00:00 https://vulnerability.circl.lu/sighting/92d2b740-237b-46f5-965b-2ad31e5e6bf7/export 2026-09-14T20:35:42.458002+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "92d2b740-237b-46f5-965b-2ad31e5e6bf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-70668", "type": "seen", "source": "https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10", "content": "", "creation_timestamp": "2026-08-19T17:16:19.909250Z"} 2026-08-19T17:16:19.909250+00:00 https://vulnerability.circl.lu/sighting/46ba0fab-49e5-4461-8377-c0d9b420eb7e/export 2026-09-14T20:35:42.458142+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "46ba0fab-49e5-4461-8377-c0d9b420eb7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70666", "type": "seen", "source": "https://gist.github.com/alon710/f8eaee2020ed8f819add6f9d1de77bf8", "content": "# CVE-2026-70666: CVE-2026-70666: Server-Side Request Forgery in Netflix Lemur ACME Authority Management\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70666\n\n## Summary\nCVE-2026-70666 is a critical Server-Side Request Forgery (SSRF) vulnerability in Netflix Lemur's ACME certificate management integration. Prior to version 1.9.3, the system allowed authority-role users to bypass initial ACME URL allowlist validations when updating an existing authority. Additionally, the underlying ACME network client blindly parsed and connected to dynamic endpoint URLs supplied in JSON responses from the configured ACME directory, allowing attackers to route arbitrary JWS-signed requests to internal services or cloud metadata endpoints.\n\n## TL;DR\nAn SSRF vulnerability in Netflix Lemur allows lower-privileged users with authority roles to update authority settings to point to a rogue ACME server. The Lemur ACME client then trusts server-supplied dynamic URLs, enabling attackers to query private internal endpoints and retrieve cloud instance credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.4\n- **Privileges Required**: Low (Tenant Authority Role)\n- **Impact**: Server-Side Request Forgery & Information Disclosure\n- **Exploit Status**: Proof of Concept available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Netflix Lemur\n- **Lemur**: < 1.9.3 (Fixed in: `1.9.3`)\n\n## Mitigation\n\n- Upgrade Netflix Lemur to version 1.9.3 or higher\n- Implement strict egress network controls on Lemur application hosts\n- Enable IMDSv2 with a hop limit of 1 on AWS deployments to prevent metadata access\n- Enforce network isolation for the Lemur instance\n\n**Remediation Steps:**\n1. Identify active ACME authorities configured in the Lemur system.\n2. Analyze database options for unauthorized domains in the 'acme_url' configuration.\n3. Apply the Lemur update to version 1.9.3.\n4. Verify that the update is successful by testing authority options modification constraints.\n\n## References\n\n- [GitHub Security Advisory GHSA-xpmj-wjcp-6pww](https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww)\n- [NVD Record Details](https://nvd.nist.gov/vuln/detail/CVE-2026-70666)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-70666)\n- [Netflix Lemur Remediation Commit](https://github.com/Netflix/lemur/commit/6dcb19b6d6004e97796d6a0344b130b2ba57f050)\n- [Netflix Lemur Release v1.9.3](https://github.com/Netflix/lemur/releases/tag/v1.9.3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70666) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T09:32:00.745356Z"} 2026-08-19T09:32:00.745356+00:00 https://vulnerability.circl.lu/sighting/849e0680-c902-46ea-83a6-62c3a2a90c2a/export 2026-09-14T20:35:42.459846+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "849e0680-c902-46ea-83a6-62c3a2a90c2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70667", "type": "seen", "source": "https://gist.github.com/alon710/db3f4019c2372dbb6dfede560d6093f7", "content": "# CVE-2026-70667: CVE-2026-70667: Server-Side Request Forgery Bypass in Netflix Lemur Certificate Verification\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70667\n\n## Summary\nA security vulnerability in Netflix Lemur, a TLS certificate management framework, allows authenticated operators to bypass Server-Side Request Forgery (SSRF) mitigations. The issue exists within the certificate revocation verification workflow, specifically inside the CRL and OCSP retrieval logic. By exploiting HTTP redirects or DNS rebinding (Time-of-Check Time-of-Use) mechanisms, an attacker can coerce the server into issuing arbitrary network requests to internal services, such as the cloud instance metadata service (IMDS) or loopback addresses. This bypass neutralizes previous network-boundary validation logic and allows blind read/write SSRF targeting internal infrastructure resources.\n\n## TL;DR\nA flaw in Netflix Lemur prior to v1.9.3 allows authenticated operators to bypass Server-Side Request Forgery (SSRF) protections. This is accomplished using DNS rebinding and HTTP redirects during certificate revocation checking (CRL/OCSP), exposing private VPC infrastructure and AWS instance metadata (IMDS).\n\n## Technical Details\n\n- **CWE ID**: CWE-918, CWE-367\n- **Attack Vector**: Network\n- **CVSS Score**: 6.3\n- **EPSS Percentile**: N/A\n- **Impact**: Server-Side Request Forgery (SSRF) bypass to internal targets\n- **Exploit Status**: Conceptual\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Netflix Lemur\n- **Lemur**: < 1.9.3 (Fixed in: `1.9.3`)\n\n## Mitigation\n\n- Upgrade Lemur to version 1.9.3 or later to enforce resolution pinning and disable redirect-following during certificate validation.\n- Implement egress firewall controls to block Lemur from making outbound calls to internal IP addresses (RFC1918) and link-local targets (169.254.169.254).\n- Restrict the certificate upload endpoint (POST /api/1/certificates/upload) to highly privileged roles.\n- Enforce AWS IMDSv2 with a hop limit of 1 to protect local metadata.\n\n**Remediation Steps:**\n1. Audit the currently deployed version of Netflix Lemur to verify if it is below 1.9.3.\n2. Pull the latest stable release of Lemur (v1.9.3) or apply commit ed504a830f38a83825b1570302e9f38d6553938a to the local codebase.\n3. Rebuild and deploy the updated Lemur container image or application package.\n4. Validate the patch by attempting to upload a test certificate containing a redirection URL pointing to a private resource. Verify that the request is rejected or fails safely.\n5. Deploy host-level firewall rules (such as iptables rules) to explicitly block outbound connections from the lemur execution user to the local metadata endpoint.\n\n## References\n\n- [GitHub Security Advisory GHSA-f3qq-49m6-rw8f](https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f)\n- [Netflix Lemur Patch Commit](https://github.com/Netflix/lemur/commit/ed504a830f38a83825b1570302e9f38d6553938a)\n- [Netflix Lemur v1.9.3 Release Notes](https://github.com/Netflix/lemur/releases/tag/v1.9.3)\n- [NVD CVE-2026-70667 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-70667)\n- [CVE Record Details](https://www.cve.org/CVERecord?id=CVE-2026-70667)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70667) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T08:31:37.459364Z"} 2026-08-19T08:31:37.459364+00:00 https://vulnerability.circl.lu/sighting/da4b2f28-68ac-48cd-a200-b0e1152cd8b3/export 2026-09-14T20:35:42.460012+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "da4b2f28-68ac-48cd-a200-b0e1152cd8b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70669", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtfzwtied22u", "content": "CVE-2026-70669 - oracle reports developer\nOracle Reports Developer, a tool used for creating and managing reports, has a security flaw that allows hackers to take control of the system without a password.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#oraclecorporation #CVE #infosec", "creation_timestamp": "2026-08-19T05:50:05.949464Z"} 2026-08-19T05:50:05.949464+00:00 https://vulnerability.circl.lu/sighting/8cfe26af-75e6-4c01-8b02-01ca5c86b8a8/export 2026-09-14T20:35:42.460117+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8cfe26af-75e6-4c01-8b02-01ca5c86b8a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70668", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtfzexeh6d2e", "content": "CVE-2026-70668 - oracle reports developer\nThe Oracle Fusion Middleware Reports Developer product, version 14.1.2.0.0, has a security issue that allows an attacker to access and modify sensitive information\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#oraclecorporation #CVE #infosec", "creation_timestamp": "2026-08-19T05:40:05.376954Z"} 2026-08-19T05:40:05.376954+00:00 https://vulnerability.circl.lu/sighting/7105fae3-81bb-4ec5-a00c-b82cf1f247ab/export 2026-09-14T20:35:42.460220+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "7105fae3-81bb-4ec5-a00c-b82cf1f247ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-70666", "type": "published-proof-of-concept", "source": "https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww", "content": "", "creation_timestamp": "2026-08-18T22:35:18.865742Z"} 2026-08-18T22:35:18.865742+00:00 https://vulnerability.circl.lu/sighting/74a3397d-7d69-4116-9289-8952e09428d4/export 2026-09-14T20:35:42.460316+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "74a3397d-7d69-4116-9289-8952e09428d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-70667", "type": "published-proof-of-concept", "source": "https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f", "content": "", "creation_timestamp": "2026-08-18T22:35:16.419805Z"} 2026-08-18T22:35:16.419805+00:00 https://vulnerability.circl.lu/sighting/6328ef58-2ff9-4a34-8d18-7e29270cb361/export 2026-09-14T20:35:42.460409+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "6328ef58-2ff9-4a34-8d18-7e29270cb361", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70669", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtfarqpvbg2e", "content": "\ud83d\udea8 CVE-2026-70669 \u2014 CVSS 9.8 CRITICAL\n\nVulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-70669\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T22:19:50.900447Z"} 2026-08-18T22:19:50.900447+00:00 https://vulnerability.circl.lu/sighting/065ed631-5c55-4b22-8817-8f32cb618b53/export 2026-09-14T20:35:42.460505+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "065ed631-5c55-4b22-8817-8f32cb618b53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70668", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtfari5vin2m", "content": "\ud83d\udea8 CVE-2026-70668 \u2014 CVSS 9.1 CRITICAL\n\nVulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-70668\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T22:19:41.876291Z"} 2026-08-18T22:19:41.876291+00:00