Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-55162 medium CVSS 6.3

SSRF (Server-Side Request Forgery) in lemur (CVE-2026-55162)

Summary

SSRF in lemur (CVE-2026-55162). Risk of unauthorized operations or information disclosure. Exploitable via POST /certificates/upload. Mitigation: upgrade to 1.9.2 or later.

Original description

The description as published by the source.

Summary

When verifying an uploaded certificate, lemur/certificates/verify.py extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An authenticated user holding the operator role (required by StrictRolePermission on POST /certificates/upload) can craft a certificate whose extensions point at internal services - instance metadata endpoints, internal Kubernetes API servers, RFC1918 hosts, link-local addresses - and cause the Lemur host to issue requests against those destinations during verification.

Root Cause

lemur/certificates/verify.py, crl_verify:

point = p.full_name[0].value                          # URL from CDP extension of uploaded cert
...
response = requests.get(point, timeout=(3.05, 6))     # no allow-list, no destination filter

lemur/certificates/verify.py, ocsp_verify:

command = ["openssl", "x509", "-noout", "-ocsp_uri", "-in", cert_path]
p1 = subprocess.Popen(command, stdout=subprocess.PIPE, ...)
url, _ = p1.communicate()
p2 = subprocess.Popen(
    ["openssl", "ocsp", "-issuer", issuer_chain_path, "-cert", cert_path,
     "-url", url.strip()],                            # attacker-controlled URL
    ...
)

In both code paths the URL flows from attacker-controlled certificate-extension content to a network sink with no validation against an allow-lis…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-55162 has been found in lemur.
Attackers can target a specific entry point like POST /certificates/upload over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 6.3/10.
What to do: upgrade lemur to 1.9.2 or later.
If unsure, ask your IT team or search "lemur CVE-2026-55162" on the vendor's site.

CVE-2026-55162 (lemur) — CWE-918 / CVSS v3 6.3
Attack vector: remote (network-reachable) / no user interaction
Attack surface: POST /certificates/upload / StrictRolePermission / crl_verify / ocsp_verify
Patched: 1.9.2 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

SSRF (CWE-918) exists in lemur. Attackers reach the vulnerable code path via POST /certificates/upload.

📍 Affected scope

Check the vendor advisory for the affected versions of lemur. Attack surface: POST /certificates/upload / StrictRolePermission / crl_verify / ocsp_verify.

🔥 Severity

Severity: Medium (CVSS 6.3/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 1.9.2.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual POST /certificates/upload requests with malformed payloads or SQL meta-characters. Run grep -r 'lemur' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'lemur' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で lemur を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Hunt for indicators of compromise detect 
    grep 'POST /certificates/upload' /var/log/nginx/access.log | grep -E '(unusual_payload|sqli_pattern)'

    アクセスログで POST /certificates/upload への異常なリクエスト (不正な認証ヘッダ・SQLメタ文字)を過去 30〜90日分捜索。WAF/SIEM があれば該当パスのアラート発火履歴を確認。

  3. 3
    Apply patch patch 
    Upgrade lemur to 1.9.2

    ステージング環境で 1.9.2 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスと、Step 2 で見つけた異常検知の続報チェックを含めること。

  4. 4
    Post-deployment verification verify 
    Replay attack against POST /certificates/upload on staging to confirm patch closes the vector

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 2 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

pip lemur
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2"}]}]
PyPI lemur
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details