CVE-2026-55166

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55166
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55166.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55166
Aliases
Published
2026-08-18T18:51:41.495Z
Modified
2026-08-19T12:10:20.198708774Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L CVSS Calculator
Summary
Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR
Details

Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acmeurl without an effective server-side destination restriction and trigger AcmeHandler.setupacmeclient to make backend requests. An attacker could target cloud instance metadata or internal services from Lemur network context, potentially obtaining credentials available to the host. The advisory also identifies creator-equality authorization behavior that could preserve access to certificate key material after ownership or role changes, with insufficient exportprivatekey audit context to distinguish that access path. Together, the acmeurl server-side request forgery and authorization weakness could expose cloud credentials and long-lived PKI private-key access. The fix adds ACMEDIRECTORYHOST_ALLOWLIST validation and enriches key-export audit events with creator and current-owner context. This issue is fixed in version 1.9.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-285",
        "CWE-639",
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55166.json"
}
References

Affected packages

Git / github.com/netflix/lemur

Affected ranges

Type
GIT
Repo
https://github.com/netflix/lemur
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4afd730de39fa9370f6c24ea8af7fcaa45430310
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.9.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1
0.1.2
0.1.3
0.1.4
0.1.5
0.2
0.2.1
0.2.2
0.3.0
0.4.0
0.5.0
0.6.0
0.7.0
0.8.0
v0.*
v0.10.0
v0.11.0
v0.8.1
v0.9.0
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.8.1
v1.8.2
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55166.json"