Credential and key exposure via SSRF and IDOR

SSRF and authorization bypass in Netflix Lemur before 1.9.2 allow remote authenticated users to read cloud credentials and private keys. The ACME handler accepts a user-influenced acme_url and passes it to ClientV2.get_directory without effective destination restriction, allowing backend requests to reach instance-metadata or internal services; the key-fetch view also skips CertificatePermission when the caller matches cert.user, so the original creator can still export a certificate's private key after ownership changes. Exploitation requires an authenticated Lemur account and, for the key-access path, creator status on the certificate; the advisory states that pre-1.9.2 audit data did not clearly distinguish creator-based key exports after transfer.