Server-side Request Forgery (SSRF) Affecting lemur package, versions [,1.9.2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-LEMUR-17661117
- published28 Jun 2026
- disclosed25 Jun 2026
- creditsour-exploit
Introduced: 25 Jun 2026
CVE-2026-55162 (opens in a new tab)How to fix?
Upgrade lemur to version 1.9.2 or higher.
Overview
lemur is a Certificate management and orchestration service
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the verify_string process when extracting CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions. An attacker can induce the host to make arbitrary outbound requests to internal or external destinations by uploading a crafted certificate with malicious URLs in its extensions. This can allow probing of internal network services, exposure of sensitive metadata, and persistent cache poisoning through attacker-controlled CRLs.