https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 22 Aug 2026 09:14:20 +0000 https://vulnerability.circl.lu/sighting/46ba0fab-49e5-4461-8377-c0d9b420eb7e/export {"uuid": "46ba0fab-49e5-4461-8377-c0d9b420eb7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70666", "type": "seen", "source": "https://gist.github.com/alon710/f8eaee2020ed8f819add6f9d1de77bf8", "content": "# CVE-2026-70666: CVE-2026-70666: Server-Side Request Forgery in Netflix Lemur ACME Authority Management\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70666\n\n## Summary\nCVE-2026-70666 is a critical Server-Side Request Forgery (SSRF) vulnerability in Netflix Lemur's ACME certificate management integration. Prior to version 1.9.3, the system allowed authority-role users to bypass initial ACME URL allowlist validations when updating an existing authority. Additionally, the underlying ACME network client blindly parsed and connected to dynamic endpoint URLs supplied in JSON responses from the configured ACME directory, allowing attackers to route arbitrary JWS-signed requests to internal services or cloud metadata endpoints.\n\n## TL;DR\nAn SSRF vulnerability in Netflix Lemur allows lower-privileged users with authority roles to update authority settings to point to a rogue ACME server. The Lemur ACME client then trusts server-supplied dynamic URLs, enabling attackers to query private internal endpoints and retrieve cloud instance credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.4\n- **Privileges Required**: Low (Tenant Authority Role)\n- **Impact**: Server-Side Request Forgery & Information Disclosure\n- **Exploit Status**: Proof of Concept available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Netflix Lemur\n- **Lemur**: < 1.9.3 (Fixed in: `1.9.3`)\n\n## Mitigation\n\n- Upgrade Netflix Lemur to version 1.9.3 or higher\n- Implement strict egress network controls on Lemur application hosts\n- Enable IMDSv2 with a hop limit of 1 on AWS deployments to prevent metadata access\n- Enforce network isolation for the Lemur instance\n\n**Remediation Steps:**\n1. Identify active ACME authorities configured in the Lemur system.\n2. Analyze database options for unauthorized domains in the 'acme_url' configuration.\n3. Apply the Lemur update to version 1.9.3.\n4. Verify that the update is successful by testing authority options modification constraints.\n\n## References\n\n- [GitHub Security Advisory GHSA-xpmj-wjcp-6pww](https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww)\n- [NVD Record Details](https://nvd.nist.gov/vuln/detail/CVE-2026-70666)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-70666)\n- [Netflix Lemur Remediation Commit](https://github.com/Netflix/lemur/commit/6dcb19b6d6004e97796d6a0344b130b2ba57f050)\n- [Netflix Lemur Release v1.9.3](https://github.com/Netflix/lemur/releases/tag/v1.9.3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70666) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T09:32:00.745356Z"} {"uuid": "46ba0fab-49e5-4461-8377-c0d9b420eb7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70666", "type": "seen", "source": "https://gist.github.com/alon710/f8eaee2020ed8f819add6f9d1de77bf8", "content": "# CVE-2026-70666: CVE-2026-70666: Server-Side Request Forgery in Netflix Lemur ACME Authority Management\n\n> **CVSS Score:** 7.4\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70666\n\n## Summary\nCVE-2026-70666 is a critical Server-Side Request Forgery (SSRF) vulnerability in Netflix Lemur's ACME certificate management integration. Prior to version 1.9.3, the system allowed authority-role users to bypass initial ACME URL allowlist validations when updating an existing authority. Additionally, the underlying ACME network client blindly parsed and connected to dynamic endpoint URLs supplied in JSON responses from the configured ACME directory, allowing attackers to route arbitrary JWS-signed requests to internal services or cloud metadata endpoints.\n\n## TL;DR\nAn SSRF vulnerability in Netflix Lemur allows lower-privileged users with authority roles to update authority settings to point to a rogue ACME server. The Lemur ACME client then trusts server-supplied dynamic URLs, enabling attackers to query private internal endpoints and retrieve cloud instance credentials.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.4\n- **Privileges Required**: Low (Tenant Authority Role)\n- **Impact**: Server-Side Request Forgery & Information Disclosure\n- **Exploit Status**: Proof of Concept available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Netflix Lemur\n- **Lemur**: < 1.9.3 (Fixed in: `1.9.3`)\n\n## Mitigation\n\n- Upgrade Netflix Lemur to version 1.9.3 or higher\n- Implement strict egress network controls on Lemur application hosts\n- Enable IMDSv2 with a hop limit of 1 on AWS deployments to prevent metadata access\n- Enforce network isolation for the Lemur instance\n\n**Remediation Steps:**\n1. Identify active ACME authorities configured in the Lemur system.\n2. Analyze database options for unauthorized domains in the 'acme_url' configuration.\n3. Apply the Lemur update to version 1.9.3.\n4. Verify that the update is successful by testing authority options modification constraints.\n\n## References\n\n- [GitHub Security Advisory GHSA-xpmj-wjcp-6pww](https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww)\n- [NVD Record Details](https://nvd.nist.gov/vuln/detail/CVE-2026-70666)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-70666)\n- [Netflix Lemur Remediation Commit](https://github.com/Netflix/lemur/commit/6dcb19b6d6004e97796d6a0344b130b2ba57f050)\n- [Netflix Lemur Release v1.9.3](https://github.com/Netflix/lemur/releases/tag/v1.9.3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70666) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T09:32:00.745356Z"} https://vulnerability.circl.lu/sighting/46ba0fab-49e5-4461-8377-c0d9b420eb7e/export Wed, 19 Aug 2026 09:32:00 +0000 https://vulnerability.circl.lu/sighting/7105fae3-81bb-4ec5-a00c-b82cf1f247ab/export {"uuid": "7105fae3-81bb-4ec5-a00c-b82cf1f247ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-70666", "type": "published-proof-of-concept", "source": "https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww", "content": "", "creation_timestamp": "2026-08-18T22:35:18.865742Z"} {"uuid": "7105fae3-81bb-4ec5-a00c-b82cf1f247ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-70666", "type": "published-proof-of-concept", "source": "https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww", "content": "", "creation_timestamp": "2026-08-18T22:35:18.865742Z"} https://vulnerability.circl.lu/sighting/7105fae3-81bb-4ec5-a00c-b82cf1f247ab/export Tue, 18 Aug 2026 22:35:18 +0000