CVE-2026-71307

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:11+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-6c8m-q6g9-vrw3 2026-08-19 06:44:38+00:00| seen| https://gist.github.com/alon710/d3bb7a8e835fd653e6c886cd85f28aa2...

CVE-2026-71307 Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required adminpermission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting...

CVE-2026-71307

In Lemur before 1.9.3, GET /api/1/destinations endpoints required only basic authentication, allowing low-privilege users to read plaintext SFTP passwords and private-key passphrases stored by the sftp-destination plugin. CVSS 7.7 HIGH (network, low complexity). Fixed in 1.9.3 by requiring admin ...