Lemur, a TLS certificate manager, performs CRL and OCSP revocation checks when certificates are uploaded. Before version 1.9.3 the checker validated the original URL but followed HTTP redirects without re‑validating each intermediate Location header and performed separate DNS lookups for the final request. This allowed an attacker‑controlled URL to redirect to addresses such as loopback, RFC1918, link‑local or instance‑metadata servers. The separate DNS resolutions also introduced a time‑of‑check to time‑of‑use window, enabling DNS rebinding attacks. Consequently, an actor that can supply a crafted certificate via the /api/1/certificates/upload endpoint can force Lemur to issue blind internal requests to private infrastructure, exposing internal services or enabling further lateral movement.

All Netflix Lemur releases older than 1.9.3 are vulnerable. The issue is triggered when a certificate that points to a revocation URL is uploaded, causing Lemur to perform a CRL/OCSP check that follows redirects or a rebinding. The problem exists only in the credential remoting logic used by the upload API.

The CVSS score of 6.3 indicates moderate severity. EPSS is not available and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires access to the certificate upload API, which is typically limited to operators or administrators. Once that access is gained, the attacker can supply a crafted certificate that induces blind internal requests, yielding SSRF‑style exposure of internal resources. The vulnerability has a clear attack path, but the need for upload‑API access and the blind nature of the requests suggest a moderate effort for a motivated adversary.