Detections
Analytics

SCA: security update for lemur (GHSA-xpmj-wjcp-6pww)

high Tenable Self-Hosted Container Security Plugin ID 446095

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url
 through PUT /api/1/authorities/ without revalidation and direct setup_acme_client_no_retry to an attacker-
 controlled ACME server. ACME directory and order responses contain newNonce, newOrder, authorizations, and
 finalize URLs chosen by that server. The Lemur ClientV2 followed those URLs without requiring their host
 to match the configured directory host, allowing JWS-signed requests to internal services or cloud
 metadata endpoints. The issue required an ACME authority and a user authorized for that authority, but did
 not require global administrator privileges. The fix revalidates updates and introduces
 _PinnedClientNetwork to enforce a single allowed host for the complete ACME flow. This issue is fixed in
 version 1.9.3. (CVE-2026-70666)

Solution

Update the lemur library and its related packages to version 1.9.3 or later.

See Also

https://github.com/advisories/GHSA-xpmj-wjcp-6pww

Plugin Details

Severity: High

ID: 446095

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/19/2026

Updated: 8/19/2026

Risk Information

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2026-70666

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/18/2026

Vulnerability Publication Date: 8/18/2026

Reference Information

CVE: CVE-2026-70666

cwe: CWE-918