CVE-2026-71307: Lemur Information Disclosure Vulnerability

CVE-2026-71307 Overview

CVE-2026-71307 is a missing authorization vulnerability [CWE-862] in Netflix Lemur, an open-source tool that manages TLS certificate creation. Versions prior to 1.9.3 exposed the GET /api/1/destinations and GET /api/1/destinations/ endpoints to any authenticated user. Sibling write handlers required admin_permission, but the read handlers did not. The DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext. A read-only account could retrieve credentials for remote certificate-deployment hosts and TLS material outside Lemur's security boundary.

Critical Impact
Any authenticated Lemur user could read plaintext SFTP passwords and private key passphrases, granting direct access to remote certificate-deployment hosts and associated TLS assets.

Affected Products

Netflix Lemur versions prior to 1.9.3
Lemur deployments using the sftp-destination plugin
Any Lemur destination plugin storing options flagged as sensitive

Discovery Timeline

2026-08-18 - CVE CVE-2026-71307 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-71307

Vulnerability Analysis

Lemur exposes destinations through a REST API for managing where issued TLS certificates are deployed. Write endpoints for destinations enforced administrator scope, but the corresponding read endpoints only required authentication. This asymmetry allowed low-privilege users to enumerate destination configurations. The response schema serialized every option field verbatim, including secrets. Destination plugins such as sftp-destination persisted credentials in plaintext rather than encrypting them at rest. The combination let any authenticated caller retrieve SFTP passwords and private key passphrases through a routine API request.

Root Cause

The root cause is missing authorization [CWE-862] on the destinations read handlers combined with unfiltered serialization of plugin options. The fill_object post-dump hook in lemur/destinations/schemas.py copied options into plugin.pluginOptions without checking the sensitive flag on each option. Because credentials were stored in plaintext, no cryptographic layer prevented disclosure once the API returned the values.

Attack Vector

An attacker with any authenticated Lemur account issues a GET request against /api/1/destinations or /api/1/destinations/{id}. The response includes the destination's pluginOptions array with plaintext password and privateKeyPass values for sftp-destination entries. The attacker then uses those credentials to log in directly to the remote SFTP hosts hosting deployed TLS certificates and private keys.

python

# Security patch in lemur/destinations/views.py
        super().__init__()

    @validate_schema(None, destinations_output_schema)
+    @admin_permission.require(http_exception=403)
    def get(self):
        """
        .. http:get:: /destinations

Source: GitHub Commit 751c970

python

# Security patch in lemur/destinations/schemas.py
    @post_dump
    def fill_object(self, data):
        if data:
+            for option in data.get("options", []):
+                if option.get("sensitive"):
+                    option["value"] = None
            data["plugin"]["pluginOptions"] = data["options"]
            for option in data["plugin"]["pluginOptions"]:
                if "export-plugin" in option["type"]:

Source: GitHub Commit 751c970

The patch enforces admin_permission on the read handler and nulls out any option marked sensitive before serialization.

Detection Methods for CVE-2026-71307

Indicators of Compromise

Requests to /api/1/destinations or /api/1/destinations/{id} from non-administrator accounts in Lemur access logs.
Response bodies from the destinations API containing non-null value fields for options named password or privateKeyPass.
Unexpected SFTP authentication events on certificate-deployment hosts sourced from workstations that do not normally reach those systems.

Detection Strategies

Audit Lemur application logs for GET calls to destination endpoints and correlate the calling user's role. Any non-admin retrieval before upgrading to 1.9.3 should be treated as potential credential exposure.
Review SFTP server authentication logs for logins that immediately follow Lemur destination reads and originate from unusual source addresses.

Monitoring Recommendations

Ingest Lemur and SFTP host authentication logs into a centralized analytics platform and alert on cross-source credential reuse.
Rotate and monitor any SFTP or private-key passphrase that was ever configured in Lemur prior to 1.9.3, and alert on their use going forward.

How to Mitigate CVE-2026-71307

Immediate Actions Required

Upgrade all Lemur deployments to version 1.9.3 or later without delay.
Rotate every credential ever stored in a Lemur destination, including SFTP passwords and private key passphrases.
Review and reduce the population of authenticated Lemur accounts, revoking any that no longer require access.

Patch Information

The fix is included in Lemur 1.9.3. It requires admin_permission for destination reads and redacts option values flagged as sensitive in DestinationOutputSchema.fill_object. See the GitHub Release v1.9.3 and the GitHub Security Advisory GHSA-6c8m-q6g9-vrw3.

Workarounds

If upgrading immediately is not possible, restrict network access to the Lemur API so only administrator workstations can reach it.
Remove or disable destination entries that use the sftp-destination plugin until the upgrade is complete.
Enforce a strict role review so that only administrators hold authenticated accounts on the affected Lemur instance.

bash

# Upgrade Lemur to the patched release
pip install --upgrade 'lemur==1.9.3'

# Verify the running version
lemur --version