CVE-2026-55162 Netflix CVE debrief

Who should care

Operators and administrators of Lemur instances, especially those with certificate upload features exposed to authenticated users, should assess exposure and prioritize validation of internal service reachability.

Why it matters

This vulnerability allows an authenticated operator to potentially probe or affect internal services from the Lemur host network position. Operators and administrators of Lemur instances should assess exposure, especially if certificate upload features are exposed to authenticated users, and prioritize validation of internal service reachability and implementation of explicit trusted-host allowlists.

• Potential probing of internal services from Lemur host network position
• Possible creation of side effects on internal services
• Need for validation of instance-metadata destination protections
• Requirement for explicit trusted-host allowlists for CRL and OCSP responders

Technical summary

Prior to Lemur version 1.9.2, the verify.py module accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions without adequate destination validation. This allowed an authenticated operator to submit a certificate that could cause verify_string to reach internal services, potentially probing or affecting them. The vulnerability enables an attacker to probe or affect internal services from the Lemur host network position, emphasizing the need for validation of internal service reachability and implementation of explicit trusted-host allowlists.

Defensive priority

Operators should assess exposure and prioritize validation of internal service reachability, especially for instances with certificate upload features exposed to authenticated users.

Recommended defensive actions

• Validate internal service reachability from Lemur host network position
• Assess exposure of certificate upload features to authenticated users
• Verify instance-metadata destination protections
• Implement explicit trusted-host allowlists for CRL and OCSP responders
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including the affected version and fixed version. However, the scope of affected deployments and instances requires further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.