CVE-2026-55166: Netflix Lemur ACME SSRF + IDOR Chain Enables AWS IAM and PKI Compromise
Vulnerability Overview
CVE-2026-55166 is a critical (CVSS 9.9) exploit chain in Netflix Lemur, the open-source certificate management platform. It combines two distinct weaknesses: a Server-Side Request Forgery (CWE-918) in Lemur's ACME protocol handler and an Insecure Direct Object Reference (CWE-639 / CWE-285) arising from a flawed creator-equality authorization check.
The SSRF allows an attacker to coerce Lemur's backend into making arbitrary outbound HTTP requests — including to the AWS Instance Metadata Service (IMDS) endpoint — effectively stealing IAM credentials attached to the host instance role. The IDOR compounds the impact by allowing unauthorized actors to manipulate certificate objects owned by other users, bypassing authorization controls entirely. Together, the chain can pivot a low-privileged certificate requester into full AWS IAM credential theft and PKI infrastructure compromise.
Affected Software
- Package:
lemur(pip / PyPI) - Vendor: Netflix
- Vulnerable versions: all releases prior to
1.9.2
No patched release has been confirmed at time of publication — patchedDate is currently null. Organizations running any Lemur instance below 1.9.2 should treat this as unpatched until an official fix is released.
Exploitation Status
A public proof-of-concept is available. This is not a theoretical attack — weaponization barriers are low. The PoC was disclosed on 2026-06-25, meaning threat actors have immediate access to working exploit code. Defenders should assume active exploitation attempts are imminent, particularly in environments where Lemur is internet-accessible or exposed to untrusted internal networks. The AWS IAM credential theft angle makes this especially attractive to cloud-targeting adversaries.
How Our Detections Catch It
The df00tech detection package ships query coverage across seven SIEM platforms for this CVE:
- Microsoft Sentinel (KQL)
- Splunk (SPL)
- Elastic (EQL)
- IBM QRadar (AQL)
- Sumo Logic
- Chronicle (YARA-L)
- CrowdStrike (CQL)
Detection logic targets three behavioral signals characteristic of this exploit chain: anomalous outbound SSRF-pattern requests originating from the Lemur process (particularly targeting 169.254.169.254 or internal metadata endpoints), IDOR-indicative certificate API calls where the requesting principal does not match the resource owner, and unexpected IAM credential retrieval or usage shortly after Lemur API activity. Queries are tuned to minimize false positives in environments where Lemur legitimately contacts ACME providers.
Recommended Response Actions
- Immediately audit Lemur API logs for requests to IMDS endpoints.
- Rotate any IAM instance role credentials associated with the Lemur host.
- Block IMDS access from the Lemur container/VM using IMDSv2 enforcement or firewall rules as an interim control.
- Monitor for certificate issuance anomalies — especially cross-owner certificate operations.
Full Detection Package
The complete KQL, SPL, EQL, AQL, Sumo Logic, YARA-L, and CQL queries for CVE-2026-55166, along with playbook guidance and atomic test mappings, are available on the CVE-2026-55166 detection page. Paid subscribers receive the full purple team package including adversary emulation steps and tuning guidance for each SIEM.