CVE-2026-70667: Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

August 18, 2026

The SSRF mitigation added for GHSA-54vg-pfh7-jq95 (_validate_revocation_url() in lemur /certificates/verify.py) can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations (RFC1918, loopback, link-local 169.254.169.254) during verification.

References

github.com/Netflix/lemur/commit/ed504a830f38a83825b1570302e9f38d6553938a
github.com/Netflix/lemur/releases/tag/v1.9.3
github.com/Netflix/lemur/security/advisories/GHSA-f3qq-49m6-rw8f
github.com/advisories/GHSA-f3qq-49m6-rw8f
nvd.nist.gov/vuln/detail/CVE-2026-70667

Code Behaviors & Features

Detect and mitigate CVE-2026-70667 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →