CVE-2026-71307
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Lemur before version 1.9.3 exposed GET /api/1/destinations and GET /api/1/destinations/ with only authentication, without requiring admin permission, and responses included raw options with plaintext passwords and private keys. This allowed a read-only user to retrieve credentials for remote certificate-deployment hosts. The issue is fixed in version 1.9.3.
Risk Assessment
The risk includes exposure of credentials to SFTP systems and TLS material, potentially enabling unauthorized access to infrastructure outside Lemur's security boundary. This could lead to compromise of the entire certificate management process.
Recommendation
Upgrade Lemur to version 1.9.3 or later and immediately rotate any credentials that may have been exposed. Also restrict access to destinations endpoints to administrators only.
Original NVD description (English source)
Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allowing even a read-only user to retrieve credentials for remote certificate-deployment hosts. The exposed credentials could permit direct access to SFTP systems and TLS material outside the Lemur security boundary. The fix requires administrator permission for destination reads and redacts options marked sensitive. This issue is fixed in version 1.9.3.