安全情报快照 · 风险级别：中危 · CVSS：4.8 · CVE-2026-55165 · GHSA-r9gp-7f88-9r54

先看结论

lemur存在服务端请求伪造风险，< 1.9.2 受影响，建议升级至 1.9.2。

影响范围

生态	组件	受影响版本	首个修复版本
pip	`lemur`	< 1.9.2	1.9.2

处置建议

优先将 lemur 升级至 1.9.2 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Field	Value
Title	Lemur 1.9.0: JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosure
Component	lemur/lemur/auth/service.py:130-137
CWE	CWE-347 (Improper Verification of Cryptographic Signature)
Attack Prerequisite	Defense-in-depth gap on its own — no single-request exploit against PyJWT 2.x. Single-request ATO requires a separate disclosure issue that leaks LEMUR_TOKEN_SECRET, or a future migration to asymmetric signing without fixing this sink.
Affected Versions	github.com/Netflix/lemur version = "1.9.0". Same code present in every prior release that has the auth/service.py:130 block.

Exploit Code & Lab Set-up

Lemur-jwt-alg-hardening.zip

sequenceDiagram
    participant Attacker
    participant Lemur as Lemur API
    participant Disclosure as Disclosure surface
    participant Audit as Audit logging

    Note over Attacker,Lemur: "Today: PyJWT 2.x mitigation holds for alg=none"
    Attacker->>Lemur: "Bearer alg=none token with [payload]"
    Lemur->>Lemur: "pyjwt.decode raises (alg=none + non-None key)"
    Lemur-->>Attacker: "403 Forbidden"

    Note over Disclosure,Lemur: "Chain step: separate disclosure leaks LEMUR_TOKEN_SECRET"
    Attacker->>Disclosure: "trigger debug / SSRF / backup leak"
    Disclosure-->>Attacker: "LEMUR_TOKEN_SECRET value"

    Note over Attacker,Lemur: "Forge HS256 admin token with leaked secret"
    Attacker->>Lemur: "Bearer alg=HS256 admin token signed with leaked secret"
    Lemur->>Lemur: "algorithms=[HS256] (taken from header) — accepted"
    Lemur-->>Attacker: "200 OK, role=admin"

    Note over Audit: "alg=HS256 in audit log - no anomaly flag because attacker picks alg"

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。

【中危】lemur：服务端请求伪造风险（GHSA-r9gp-7f88-9r54）

先看结论

影响范围

处置建议

上游技术详情（原文）

Exploit Code & Lab Set-up

来源与许可

评论