🚨 CRITICAL - Lemur ACME SSRF + private key authorization bypass chain (CVE-2026-55166) CVE-2026-55166 impacts Lemur’s ACME authority creation endpoint, which will fetch an attacker-supplied acme_url and can be abused to force outbound requests from the Lemur server. The root issues are server-side request forgery (SSRF) due to improper URL/input validation, plus a separate authorization flaw that fails to enforce updated certificate ownership when accessing private keys. An attacker only needs an authenticated SSO account (including auto-provisioned active identities) to hit the ACME authority creation flow and pivot SSRF to cloud metadata services like AWS IMDS, then leverage the auth bypass to keep retrieving private keys after ownership transfer. Real-world impact includes exfiltration of AWS IAM/STS credentials leading to cloud account compromise, and persistent unauthorized access to issued TLS private keys even after administrative remediation. 👉 Affected: lemur (versions not specified; vulnerable builds with ACME authority creation + SSO auto-provisioning) | Upgrade to No fix yet - treat as suspicious
Post summary
CVE-2026-55166 exposes SSRF and key-bypass flaws in Lemur’s ACME endpoint, allowing authenticated users to exfiltrate cloud credentials, but no PoC, exploit code, or confirmed attacks are reported, and no patch is available.