CVE-2026-55162
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Lemur before version 1.9.2 has a vulnerability in lemur/certificates/verify.py that accepts CRL and OCSP URLs from uploaded certificates without adequate destination validation. An authenticated operator can upload a certificate via POST /api/1/certificates/upload and cause verify_string to reach internal addresses such as loopback, RFC1918, link-local, or instance-metadata (e.g., 169.254.169.254). Additionally, the CRL path uses an unbounded cache, potentially leading to memory exhaustion.
Risk Assessment
An attacker could probe internal services and cause side effects from the Lemur host's network position, and also cause memory exhaustion via the unbounded CRL cache, potentially leading to denial of service.
Recommendation
Upgrade Lemur to version 1.9.2 or later, which validates destinations, supports trusted-host allowlists, and bounds the CRL cache.
Original NVD description (English source)
Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crl_verify and ocsp_verify without adequate destination validation. An authenticated operator could submit a certificate through POST /api/1/certificates/upload and cause verify_string to reach loopback, RFC1918, link-local, or instance-metadata destinations such as 169.254.169.254. The requests could probe internal services and create side effects from the Lemur host network position. The CRL path also used an unbounded cache, allowing attacker-controlled entries to persist and consume memory. The fix validates destinations, supports explicit trusted-host allowlists, and bounds the CRL cache. This issue is fixed in version 1.9.2.