{"vulnerability": "CVE-2026-70667", "sightings": [{"uuid": "74a3397d-7d69-4116-9289-8952e09428d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-70667", "type": "published-proof-of-concept", "source": "https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f", "content": "", "creation_timestamp": "2026-08-18T22:35:16.419805Z"}, {"uuid": "849e0680-c902-46ea-83a6-62c3a2a90c2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-70667", "type": "seen", "source": "https://gist.github.com/alon710/db3f4019c2372dbb6dfede560d6093f7", "content": "# CVE-2026-70667: CVE-2026-70667: Server-Side Request Forgery Bypass in Netflix Lemur Certificate Verification\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70667\n\n## Summary\nA security vulnerability in Netflix Lemur, a TLS certificate management framework, allows authenticated operators to bypass Server-Side Request Forgery (SSRF) mitigations. The issue exists within the certificate revocation verification workflow, specifically inside the CRL and OCSP retrieval logic. By exploiting HTTP redirects or DNS rebinding (Time-of-Check Time-of-Use) mechanisms, an attacker can coerce the server into issuing arbitrary network requests to internal services, such as the cloud instance metadata service (IMDS) or loopback addresses. This bypass neutralizes previous network-boundary validation logic and allows blind read/write SSRF targeting internal infrastructure resources.\n\n## TL;DR\nA flaw in Netflix Lemur prior to v1.9.3 allows authenticated operators to bypass Server-Side Request Forgery (SSRF) protections. This is accomplished using DNS rebinding and HTTP redirects during certificate revocation checking (CRL/OCSP), exposing private VPC infrastructure and AWS instance metadata (IMDS).\n\n## Technical Details\n\n- **CWE ID**: CWE-918, CWE-367\n- **Attack Vector**: Network\n- **CVSS Score**: 6.3\n- **EPSS Percentile**: N/A\n- **Impact**: Server-Side Request Forgery (SSRF) bypass to internal targets\n- **Exploit Status**: Conceptual\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Netflix Lemur\n- **Lemur**: < 1.9.3 (Fixed in: `1.9.3`)\n\n## Mitigation\n\n- Upgrade Lemur to version 1.9.3 or later to enforce resolution pinning and disable redirect-following during certificate validation.\n- Implement egress firewall controls to block Lemur from making outbound calls to internal IP addresses (RFC1918) and link-local targets (169.254.169.254).\n- Restrict the certificate upload endpoint (POST /api/1/certificates/upload) to highly privileged roles.\n- Enforce AWS IMDSv2 with a hop limit of 1 to protect local metadata.\n\n**Remediation Steps:**\n1. Audit the currently deployed version of Netflix Lemur to verify if it is below 1.9.3.\n2. Pull the latest stable release of Lemur (v1.9.3) or apply commit ed504a830f38a83825b1570302e9f38d6553938a to the local codebase.\n3. Rebuild and deploy the updated Lemur container image or application package.\n4. Validate the patch by attempting to upload a test certificate containing a redirection URL pointing to a private resource. Verify that the request is rejected or fails safely.\n5. Deploy host-level firewall rules (such as iptables rules) to explicitly block outbound connections from the lemur execution user to the local metadata endpoint.\n\n## References\n\n- [GitHub Security Advisory GHSA-f3qq-49m6-rw8f](https://github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f)\n- [Netflix Lemur Patch Commit](https://github.com/Netflix/lemur/commit/ed504a830f38a83825b1570302e9f38d6553938a)\n- [Netflix Lemur v1.9.3 Release Notes](https://github.com/Netflix/lemur/releases/tag/v1.9.3)\n- [NVD CVE-2026-70667 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-70667)\n- [CVE Record Details](https://www.cve.org/CVERecord?id=CVE-2026-70667)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70667) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T08:31:37.459364Z"}]}