Loading vulnerability…
CVE-2026-55166 affects Netflix Lemur versions prior to 1.9.2. The vulnerability includes a server-side request forgery condition in Lemur's ACME authority handling that allows an authenticated user to influence the ACME authority URL and cause AcmeHandler.setup_acme_client to initiate backend requests without effective server-side destination restriction. From the Lemur host's network context, those requests can be directed toward cloud instance metadata services or internal network services. The advisory also describes an authorization weakness in creator-equality behavior that can preserve access to certificate key material after ownership or role changes, while private-key export auditing lacks sufficient context to clearly distinguish that access path. In combination, these weaknesses can expose cloud credentials and undermine control over long-lived PKI private keys. The issue is fixed in Lemur 1.9.2 by adding ACME_DIRECTORY_HOST_ALLOWLIST validation and enriching key-export audit events with creator and current-owner context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previous SSRF vulnerability in Netflix Lemur whose partial fix in version 1.9.2 introduced the incomplete remediation that led to CVE-2026-71303.
A vulnerability in Netflix Lemur prior to 1.9.2 involving an ACME URL server-side request forgery combined with authorization weaknesses that could expose cloud credentials and permit continued access to certificate private key material.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.