CVE-2026-71303 Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist
A non-admin user can bypass allowlist checks to set an internal ACME URL, triggering Server-Side Request Forgery to access internal services or cloud metadata.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71303?
CVE-2026-71303 is a high-severity server-side request forgery vulnerability in Netflix lemur, published on 18 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the stored acme_url with an internal service or instance-metadata URL such as 169.254.169.254. The next issuance operation loaded that value and passed it to ClientV2.get_directory, causing an outbound request from the Lemur backend. This bypassed the creation-time mitigation for CVE-2026-55166 and could expose internal services or cloud metadata. The fix revalidates acme_url whenever authority options are updated. This issue is fixed in version 1.9.3.
Weakness: CWE-918
Which versions are affected by CVE-2026-71303?
3 open source packages ship an affected version, including lemur.
| Package | Affected | Fixed in |
|---|---|---|
lemur PyPI | All versions | 1.9.3 |
lemur PyPI | All versions | 1.9.3 |
lemur PyPI | All versions | 1.9.3 |
How do I fix CVE-2026-71303?
Upgrade lemur to 1.9.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-71303 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71303 exists.
Sources
Also known as GHSA-v5rc-cpwc-cfpr, PYSEC-2026-3679.