An attacker who possesses a user account with authority role can change the ACME server endpoint (acme_url) used by Lemur via the PUT /api/1/authorities/ endpoint. Because Lemur’s ACME client follows the URLs returned in the ACME directory, nonce, order, authorization, and finalization responses without checking that the host matches the originally configured directory host, an attacker‑controlled ACME server can instruct Lemur to send authenticated JWS requests to arbitrary internal services or cloud metadata endpoints. This Server‑Side Request Forgery can be used to exfiltrate data from internal systems or to trigger further internal attacks. The vulnerability does not grant global administrative rights; any role that can update an authority is sufficient.

The issue affects all installations of Netflix Lemur earlier than version 1.9.3, specifically those that allow authority‑role members to edit the acme_url field. It impacts systems where the vulnerable API is exposed to legitimate users and where the ACME client is in use for certificate issuance. The vulnerability is fixed in Lemur v1.9.3 and later.

An attacker must first authenticate as a valid user with authority privileges, which may be achieved through credential compromise or phishing. Once authenticated, the attacker can issue a request to the PUT /api/1/authorities/ endpoint, set an attacker‑controlled ACME server, and then leverage the unvalidated redirects to force Lemur to contact internal hostnames. The CVSS score of 7.4 indicates a high impact risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a known public exploit does not reduce the potential threat, particularly when the attacker has legitimate account access. The vulnerability can allow disclosure of sensitive internal data or serve as a pivot for further internal attacks.