CVE-2026-71307

Received Received - Intake

Lemur Destination API Credential Exposure via Unauthorized Access

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allowing even a read-only user to retrieve credentials for remote certificate-deployment hosts. The exposed credentials could permit direct access to SFTP systems and TLS material outside the Lemur security boundary. The fix requires administrator permission for destination reads and redacts options marked sensitive. This issue is fixed in version 1.9.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-71307

EUVD

EUVD-2026-61153

Affected Vendors & Products

Vendor	Product	Version / Range
netflix	lemur	1.9.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Lemur (prior to version 1.9.3) allows authenticated low-privilege users to read plaintext credentials for remote certificate-deployment hosts via the destinations API. The issue occurs because read endpoints for destinations do not enforce admin-level authorization, unlike write endpoints. Sensitive values like SFTP passwords and private key passphrases are stored in plaintext and exposed in API responses without redaction.

Detection Guidance

To detect this vulnerability, check if your Lemur instance is running a version prior to 1.9.3. Use commands like 'curl -X GET http://<lemur-server>/api/1/destinations' to test if sensitive credentials are exposed in API responses. Verify if non-admin users can access destination details containing plaintext passwords or private key passphrases.

Impact Analysis

An attacker with read-only access to Lemur could retrieve credentials for SFTP systems or other remote hosts used for certificate deployment. This could allow unauthorized access to those systems, potentially leading to data breaches, unauthorized file transfers, or further exploitation of connected infrastructure. The impact includes compromised remote hosts and exposure of TLS materials outside Lemur's security boundary.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access controls. It exposes sensitive credentials (e.g., SFTP passwords) that could lead to unauthorized access to personal or health data, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Organizations using Lemur may face regulatory penalties or audit failures due to inadequate access controls and plaintext credential storage.

Mitigation Strategies

Upgrade Lemur to version 1.9.3 or later immediately. Ensure all destination credentials are rotated after the upgrade. Review API access logs to identify unauthorized access attempts. Restrict network access to Lemur API endpoints to trusted IPs only.

Hi! I’m here to help you understand CVE-2026-71307. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70