CVE-2026-70666

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-70666
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70666.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-70666
Aliases
Published
2026-08-18T19:05:26.621Z
Modified
2026-08-20T03:55:02.512929114Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
Summary
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
Details

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientno_retry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder, authorizations, and finalize URLs chosen by that server. The Lemur ClientV2 followed those URLs without requiring their host to match the configured directory host, allowing JWS-signed requests to internal services or cloud metadata endpoints. The issue required an ACME authority and a user authorized for that authority, but did not require global administrator privileges. The fix revalidates updates and introduces _PinnedClientNetwork to enforce a single allowed host for the complete ACME flow. This issue is fixed in version 1.9.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70666.json",
    "cwe_ids": [
        "CWE-918"
    ]
}
References

Affected packages

Git / github.com/netflix/lemur

Affected ranges

Type
GIT
Repo
https://github.com/netflix/lemur
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6dcb19b6d6004e97796d6a0344b130b2ba57f050
Fixed
726506d15a6da8d9bcf5c39b4dc0c95535cf03c0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.9.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1
0.1.2
0.1.3
0.1.4
0.1.5
0.2
0.2.1
0.2.2
0.3.0
0.4.0
0.5.0
0.6.0
0.7.0
0.8.0
v0.*
v0.10.0
v0.11.0
v0.8.1
v0.9.0
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.8.1
v1.8.2
v1.9.0
v1.9.1
v1.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70666.json"