---
title: "CVE-2026-55166: Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise"
url: https://erroneo.us/security/cve/CVE-2026-55166/
description: "CVE-2026-55166 (lemur (PyPI)): Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acmeurl without…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-08-18
date_modified: 2026-08-18
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-55166"
kev: false
cvss: 9.9
epss: 0.00287
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-55166: Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.3% , percentile 20: FIRST’s model estimates a 0.3% chance of exploitation activity in the next 30 days, higher than 20% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes lemur (PyPI) < 1.9.2, fixed in 1.9.2 . Check your lockfile, including transitive dependencies.

## What it is

Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acmeurl without an effective server-side destination restriction and trigger AcmeHandler.setupacmeclient to make backend requests. An attacker could target cloud instance metadata or internal services from Lemur network context, potentially obtaining credentials available to the host. The advisory also identifies creator-equality authorization behavior that could preserve access to certificate key material after ownership or role changes, with insufficient exportprivatekey audit context to distinguish that access path. Together, the acmeurl server-side request forgery and authorization weakness could expose cloud credentials and long-lived PKI private-key access. The fix adds ACMEDIRECTORYHOSTALLOWLIST validation and enriches key-export audit events with creator and current-owner context. This issue is fixed in version 1.9.2.

## Affected packages

- PyPI `lemur` < 1.9.2 → fixed: 1.9.2

## Affected products (CVE record)

- Netflix lemur: < 1.9.2

## Severity

- GitHub_M CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L`
- GitHub CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.29% probability of exploitation activity in the next 30 days; percentile 20.

## Sources

- [GitHub Advisory GHSA-v2wp-frmc-5q3v](https://github.com/advisories/GHSA-v2wp-frmc-5q3v)
- [CVE.org record CVE-2026-55166](https://www.cve.org/CVERecord?id=CVE-2026-55166)
- [NVD entry CVE-2026-55166](https://nvd.nist.gov/vuln/detail/CVE-2026-55166)
- [github.com](https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v)
- [github.com](https://github.com/Netflix/lemur/commit/872f6e282542352f2bf3f6e2bcc504ab81e1843d)
- [github.com](https://github.com/Netflix/lemur/releases/tag/v1.9.2)

---
Source page: https://erroneo.us/security/cve/CVE-2026-55166/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt