CVE-2026-55166 Netflix CVE debrief

Who should care

Defenders of Lemur deployments, cloud instance administrators, and teams responsible for certificate management and PKI should assess exposure and verify remediation. Affected operators must review compensating controls for exposed systems while remediation is scheduled and verified. Vulnerability management and security teams should prioritize updates to version 1.9.2 and monitor key export events for suspicious activity.

Why it matters

Authenticated users in Lemur prior to 1.9.2 could manipulate ACME authority URLs to make backend requests, potentially exposing cloud credentials and private key material. Defenders should verify remediation and assess exposure.

• Potential exposure of cloud credentials
• Potential exposure of long-lived PKI private-key access
• Verification of creator-equality authorization behavior
• Validation of ACME_DIRECTORY_HOST_ALLOWLIST implementation

Technical summary

The AcmeHandler.setup_acme_client in Lemur prior to 1.9.2 allows authenticated users to influence ACME authority acme_url without effective server-side destination restriction. This could trigger backend requests to cloud instance metadata or internal services, potentially obtaining credentials available to the host. The advisory also identifies creator-equality authorization behavior that could preserve access to certificate key material after ownership or role changes.

Defensive priority

High

Recommended defensive actions

• Review and update Lemur to version 1.9.2 or later
• Restrict ACME authority URLs to only allowlist of trusted hosts
• Monitor and audit key export events for suspicious activity
• Verify creator-equality authorization behavior and access controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The advisory describes a server-side request forgery and authorization weakness in Lemur's AcmeHandler.setup_acme_client. The fix adds validation and enriches audit events. Source grounding indicates that authenticated users could influence ACME authority URLs without effective server-side destination restriction. Evidence limits suggest verifying remediation and assessing exposure. Defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.