An SSRF and authorization flaw in Netflix Lemur allows authenticated users to exfiltrate cloud credentials and compromise PKI private key material.

This is a combination of an SSRF vulnerability in the ACME handler and an authorization bypass issue. Authenticated users can influence backend requests to target internal cloud metadata or access certificate keys they are not authorized to view.

Successful exploitation poses a extreme risk to cloud infrastructure security, as attackers can obtain temporary cloud credentials or long-lived PKI private keys. Given the CVSS score of 9.9, this vulnerability could facilitate widespread unauthorized access across an organization's cloud environment, leading to data breaches and potential infrastructure takeover.

Immediate Action: Update Netflix lemur to version 1.9.2 or later to implement the required ACME directory host allowlisting and enhanced audit context.

Proactive Monitoring: Review audit logs for unusual key-export events and monitor for unexpected outbound connections from the Lemur application to internal cloud metadata services (e.g., 169.254.169.254).

Compensating Controls: Restrict network access to the Lemur application to only necessary internal segments and ensure the application runs with the principle of least privilege regarding cloud service provider permissions.

Public Exploit Available: No confirmed public weaponized exploit available.

This vulnerability represents a significant risk to cloud security posture. Organizations using Lemur for certificate management must upgrade to version 1.9.2 immediately to prevent the potential exposure of critical cloud credentials and private keys.