Skip to content

Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

High severity GitHub Reviewed Published Jul 6, 2026 in Netflix/lemur • Updated Aug 18, 2026

No open alerts for this advisory

Give feedback on Dependabot alerts