External risk intelligence

Lemur SSRF and Authorization Weakness Exposes Cloud Credentials and Private Keys.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-55166

Lemur is a certificate management tool that is typically deployed within internal network infrastructure to manage PKI. While it may be web-accessible to authorized users, it is generally not designed to be a public-facing internet service. The vulnerability requires authenticated access, further limiting the likelihood of direct public internet reachability in typical deployment scenarios.

Server-Side Request Forgery

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in Lemur, a tool for managing TLS certificates. The issue allows authenticated users to exploit a flaw in how the system handles external certificate authority requests, potentially enabling attackers to access sensitive cloud credentials or long-lived private keys. These risks stem from weaknesses in server-side request forgery and authorization controls, which have been addressed in version 1.9.2.

Unauthenticated users can trigger backend requests.
Compromised credentials and private keys are at risk.
Confirm relevance and exposure to cloud credentials.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to Lemur could manipulate the ACME URL setting to trick the server into making requests to internal network resources, such as cloud instance metadata services. This could expose sensitive credentials or private keys, especially when combined with a separate authorization weakness that might allow continued access to key material even after a user's permissions change.

Authenticated user access required.
ACME URL manipulation triggers backend requests.
Risk of credential theft and private key exposure.

Live Threat

Current exploitation, exposure, and threat context

When authenticated, an attacker could trick Lemur into making backend requests to internal services or cloud instance metadata. This could allow them to steal cloud credentials or gain long-term access to private key material.

Cloud credentials and PKI private keys.
Triggering backend requests via crafted ACME URLs.
Unauthorized access to sensitive cloud resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Lemur's TLS certificate creation process and requires immediate attention from application owners and infrastructure teams. The first step is to identify all Lemur instances, assess their reachability and business criticality, and pinpoint the accountable owner for each. Remediation planning should then proceed based on this risk assessment.

Application owners and infrastructure teams.
Verify Lemur instance reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Lemur?

Lemur is an open-source tool developed by Netflix used to manage the entire lifecycle of TLS certificates within an organization. It simplifies PKI (Public Key Infrastructure) operations by automating certificate issuance, renewal, and management, often integrating with various certificate authorities and cloud environments to maintain secure communication channels.

What does CVE-2026-55166 mean for Lemur?

This CVE describes a combination of Server-Side Request Forgery (SSRF) and authorization flaws. The SSRF allows an attacker to trick the server into sending requests to internal resources it should not access. Simultaneously, authorization weaknesses can allow users to retain access to sensitive certificate keys even if their roles or ownership permissions change.

How can an attacker trigger this vulnerability?

An attacker needs an authenticated account in Lemur to manipulate the ACME URL settings. By providing a malicious URL, they force the system to perform unauthorized backend requests. This vulnerability cannot be triggered by unauthenticated users or by simply navigating the standard Lemur user interface without specifically crafting the ACME configuration.

Is my Lemur instance at risk?

Halo Surface Signal notes that Lemur is typically deployed in internal infrastructure, which often limits direct exposure to the public internet. However, because the flaw requires authenticated access, your primary risk comes from users who already have login credentials to your Lemur instance. If your environment is reachable by untrusted users, the risk profile increases significantly.

What is the first step to remediate this?

The most important action is to upgrade all Lemur installations to version 1.9.2 or later. Before applying the update, infrastructure teams should inventory all running instances, confirm who owns them, and evaluate their network reachability to prioritize systems that are most critical or potentially accessible to unauthorized personnel.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.