CVE-2026-55166: Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

Should you act?

Critical, preconditions apply

Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 0.3%, percentile 20: FIRST’s model estimates a 0.3% chance of exploitation activity in the next 30 days, higher than 20% of all scored CVEs (low). EPSS is a probability, not a verdict.
• Needs an account (low (any account)). Exposure depends on who can log in.
• Only applies if your dependency tree includes lemur (PyPI) < 1.9.2, fixed in 1.9.2. Check your lockfile, including transitive dependencies.

What it is

Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acmeurl without an effective server-side destination restriction and trigger AcmeHandler.setupacmeclient to make backend requests. An attacker could target cloud instance metadata or internal services from Lemur network context, potentially obtaining credentials available to the host. The advisory also identifies creator-equality authorization behavior that could preserve access to certificate key material after ownership or role changes, with insufficient exportprivatekey audit context to distinguish that access path. Together, the acmeurl server-side request forgery and authorization weakness could expose cloud credentials and long-lived PKI private-key access. The fix adds ACMEDIRECTORYHOSTALLOWLIST validation and enriches key-export audit events with creator and current-owner context. This issue is fixed in version 1.9.2.

From the GitHub advisory

Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acmeurl SSRF and creator-equality IDOR Vulnerability Summary

Field | Value -- | -- Title | Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acmeurl SSRF and creator-equality IDOR Component | lemur/lemur/plugins/lemuracme/acmehandlers.py:161-201 (SSRF), lemur/lemur/certificates/views.py:734 (IDOR), lemur/lemur/auth/views.py:300-308 (SSO auto-provision) CWE | CWE-918 (SSRF) + CWE-639 (Authorization Bypass Through User-Controlled Key) + CWE-285 (Improper Authorization) Attack Prerequisite | A valid SSO session against the deployment's IdP. Lemur auto-provisions any new SSO identity at active=True, so an attacker with corporate SSO (or any federated IdP Lemur trusts) clears this bar. Affected Versions | github.com/Netflix/lemur version = "1.9.0" (see lemur/lemur/about.py) and every prior release that carries the same three sinks.

Executive Summary A low-privilege user with a freshly-provisioned SSO account turns Lemur into an AWS IAM credential-exfiltration tool and walks away with a permanent copy of any TLS private key Lemur issued. Three sinks combine: (1) Lemur auto-creates every new SSO identity as active=True with no admin approval; (2) the ACME authority-creation endpoint accepts an attacker-supplied acmeurl and fetches it server-side with no allowlist, reaching EC2 IMDS at 169.254.169.254 ; (3) the certificate key-fetch endpoint grants cert.user (the original creator) unconditional access even after ownership is transferred to a different team. The combined chain hands the attacker AWS STS credentials of the lemur worker role and a PKI private key that survives the customary "rotate the owner" remediation. I reproduced the full chain in an isolated Docker lab. The recording is on asciinema and the offline .cast ships with this report. Walkthrough:

Weakness type: CWE-285, CWE-639, CWE-918.

Product: lemur (PyPI) · Assigned by: GitHub_M · Published: 2026-08-18

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: low (any account)
• User interaction: none
• Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.29% probability of exploitation activity in the next 30 days; percentile 20.

Timeline

• 2026-06-25 — GitHub-reviewed advisory GHSA-v2wp-frmc-5q3v published (critical)
• 2026-08-18 — CVE record last updated
• 2026-08-18 — CVE record published by GitHub_M

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-v2wp-frmc-5q3v github.com
2. CVE.org record CVE-2026-55166 cve.org
3. NVD entry CVE-2026-55166 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com

Critical PyPI advisories · Today’s Security Digest