An authenticated operator can upload a certificate that contains attacker‑controlled CRL Distribution Point or OCSP responder URLs. Lemur will use those URLs during certificate verification without proper destination validation, allowing the service to perform HTTP requests to arbitrary internal addresses, including RFC1918, link‑local, or instance‑metadata endpoints such as 169.254.169.254. This can result in internal network probing, side‑effects on services reachable from the Lemur host, and memory consumption from an unbounded CRL cache. The weakness is a Server Side Request Forgery (SSRF) flaw that can be exploited after authentication. The CVE is identified as CWE‑918.

The affected product is Netflix Lemur, versions prior to 1.9.2. Operators using the upload API (POST /api/1/certificates/upload) on these versions are vulnerable.

The CVSS score of 6.3 indicates a moderate risk. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Because the vulnerability requires authentication, a legitimate user with operator privileges could trigger the SSRF. An attacker lacking such privileges would need to compromise an account or gain access through other means. The vulnerability does not allow arbitrary code execution but permits internal network reconnaissance and potential side‑effect attacks from the Lemur host.