Lego does not enforce HTTPS
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-319.
Summary
Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME challenge over unencrypted HTTP, the ACME protocol requires HTTPS when a client communicates with the CA to performs ACME functions. However, the library fails to enforce HTTPS both in the original discover URL (configured by the library user) and in the subsequent addresses returned by the CAs in the directory and order objects. If users input HTTP URLs or CAs misconfigure endpoints, protocol operations occur over HTTP instead of HTTPS. This compromises privacy by exposing request/response details like account and request identifiers to network attackers. This was fixed in version 4.25.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| go-acme | lego | before 4.25.2 | 4.25.2 | Patch available | CNA |
| — | github.com/go-acme/lego (Go) | up to 4.25.1 | — | No fix listed | GHSA-q82r-2j7m-9rv4 |
| — | github.com/go-acme/lego/v3 (Go) | up to 4.25.1 | — | No fix listed | GHSA-q82r-2j7m-9rv4 |
| — | github.com/go-acme/lego/v4 (Go) | before 4.25.2 | 4.25.2 | Patch available | GHSA-q82r-2j7m-9rv4 |
- lego Vendorgo-acme Affected before 4.25.2 Fixed in 4.25.2 Patch available CNA
- github.com/go-acme/lego (Go) Vendor— Affected up to 4.25.1 Fixed in — No fix listed GHSA-q82r-2j7m-9rv4
- github.com/go-acme/lego/v3 (Go) Vendor— Affected up to 4.25.1 Fixed in — No fix listed GHSA-q82r-2j7m-9rv4
- github.com/go-acme/lego/v4 (Go) Vendor— Affected before 4.25.2 Fixed in 4.25.2 Patch available GHSA-q82r-2j7m-9rv4
Remediation
- Fix · CNA lego (go-acme) Fixed in 4.25.2
- Fix · GHSA-q82r-2j7m-9rv4 github.com/go-acme/lego/v4 (Go) Fixed in 4.25.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat OpenShift Dev Spaces
Timeline
- 2026-10-02 Threatist record created from CVE-2025-54799
- 2026-10-03 Alias added: GHSA-q82r-2j7m-9rv4
References
More go-acme vulnerabilities
- TI-2026-29346 Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider CVSS 3.1HIGH 8.8
Sources
- CVE-2025-54799 · CVE Program
- CVE-2025-54799 · NVD
- FIRST EPSS
- GHSA-q82r-2j7m-9rv4 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-54799 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences