THREAT OPS › Threat News › [GHSA] GHSA-f3qq-49m6-rw8f (medium) — Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)
[GHSA] GHSA-f3qq-49m6-rw8f (medium) — Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)
GHSA-f3qq-49m6-rw8f Severity: medium CVE: CVE-2026-70667
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)
## Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 (`_validate_revocation_url()` in `lemur /certificates/verify.py`) can be bypassed. An operator-role user who uploads a certificate wi
Indicators of compromise
- CVE-2026-70667cve
- http://169.254.169.254/...`url
- http://attacker.example/crl`url
- http://169.254.169.254/latest/meta-data/...`url
Original source: https://github.com/advisories/GHSA-f3qq-49m6-rw8f