Lemur is a TLS certificate management system. In versions before 1.9.3, the endpoint to update an authority allowed the acme_url field to be changed without reapplying the allowlist that was enforced during creation. A user with authority privileges could set the acme_url to an internal address, such as the instance‑metadata service or any private IP. When a renewal request was later processed, the stored acme_url was used to perform an outbound request, effectively allowing the attacker to reach internal services or cloud metadata that should have been inaccessible. This flaw represents a server‑side request forgery that can be exploited to expose internal resources and potentially credentials.

Netflix Lemur versions earlier than 1.9.3 are impacted. The issue is documented for the Netflix Lemur product and is fixed from version 1.9.3 onward.

The CVSS severity is 7.7. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with an authority role, which is a privileged but non‑admin level. The vulnerability can be exploited by sending an HTTP PUT request to /api/1/authorities/ to change the acme_url to a private address. No additional software or network conditions are required beyond the existing authority privileges. Because the flaw allows the backend to make an outbound connection to an arbitrary internal endpoint, it can be used for internal network reconnaissance or credential theft. The attack vector is inferred to be application‑layer, requiring authenticated HTTP requests, given the description of the update endpoint.