{"items":[{"id":"NVI-00017844","kind":"vulnerability","title":"Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-v5rc-cpwc-cfpr","CVE-2026-71303"],"plain_summary":"GitHub lists this reviewed advisory for lemur. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-7374e7cebb48f2122e8a0a54b74b3de4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-18T20:51:23.000Z","value":"7.7 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-7374e7cebb48f2122e8a0a54b74b3de4"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-7374e7cebb48f2122e8a0a54b74b3de4","url":"https://github.com/advisories/GHSA-v5rc-cpwc-cfpr","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-v5rc-cpwc-cfpr","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T20:14:33.912Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-7374e7cebb48f2122e8a0a54b74b3de4"],"technology":"lemur","known_exclusions":[],"conditions_summary":"### Summary\n\nThe fix for GHSA-v2wp-frmc-5q3v added `_validate_acme_url()` to reject `acme_url` values not in `ACME_DIRECTORY_HOST_ALLOWLIST`, but the validation is only called at **authority creation time** (POST). The authority **update** endpoint (`PUT /api/1/authorities/`) accepts and stores arbitrary `options` -- including a modified `acme_url` -- without invoking the allowlist check. Any user with an authority role (granted by an admin to allow issuing certificates via that authority) can therefore overwrite the stored `acme_url` with an internal IP or IMDS endpoint. The next certificate issuance via that authority causes Lemur's backend to fetch the attacker-controlled URL, achieving SSRF.\n\n### Details\n\n**Where the fix lives (POST path -- protected):**\n\n`lemur/plugins/lemur_acme/plugin.py` lines 333-337 (ACMEIssuerPlugin.create_authority):\n```python\nfor option in plugin_options:\n    if option.get(\"name\") == \"certificate\":\n        acme_root = option.get(\"value\")\n    if option.get(\"name\") == \"acme_url\":\n        _validate_acme_url(option.get(\"value\", \"\"))   # allowlist enforced\n```\n\n`_validate_acme_url` at line 35:\n```python\ndef _validate_acme_url(url):\n    \"\"\"Reject acme_ur","public_affected_ranges":["<= 1.9.2"]}],"null_published_at":"2026-11-05T19:10:21.474Z","source_updated_at":"2026-08-18T20:51:23.000Z","source_disclosed_at":"2026-08-18T20:51:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T20:14:33.912Z"}],"next_cursor":null,"snapshot_revision":"42594"}