Detections
Analytics

SCA: security update for lemur (GHSA-v2wp-frmc-5q3v)

critical Tenable Cloud Security Plugin ID 443989

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME
 authority acme_url without an effective server-side destination restriction and trigger
 AcmeHandler.setup_acme_client to make backend requests. An attacker could target cloud instance metadata
 or internal services from Lemur network context, potentially obtaining credentials available to the host.
 The advisory also identifies creator-equality authorization behavior that could preserve access to
 certificate key material after ownership or role changes, with insufficient export_private_key audit
 context to distinguish that access path. Together, the acme_url server-side request forgery and
 authorization weakness could expose cloud credentials and long-lived PKI private-key access. The fix adds
 ACME_DIRECTORY_HOST_ALLOWLIST validation and enriches key-export audit events with creator and current-
 owner context. This issue is fixed in version 1.9.2. (CVE-2026-55166)

Solution

Update the lemur library and its related packages to version 1.9.2 or later.

See Also

https://github.com/advisories/GHSA-v2wp-frmc-5q3v

Plugin Details

Severity: Critical

ID: 443989

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/26/2026

Updated: 8/19/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.19

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 8.7

Temporal Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:P

CVSS Score Source: CVE-2026-55166

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/25/2026

Vulnerability Publication Date: 6/25/2026

Reference Information

CVE: CVE-2026-55166