Executive brief
Lemur is a certificate lifecycle management platform used to automate the deployment of TLS certificates across infrastructure. The destinations API—which stores and retrieves credentials for certificate deployment targets (e.g., SFTP servers)—returns plaintext SSH passwords and key passphrases to any authenticated user, including those restricted to read-only access. An attacker with low-privilege Lemur access can enumerate all configured deployment destinations and extract their credentials, then authenticate directly to remote certificate deployment hosts to replace or exfiltrate TLS material.
Technical details
The vulnerability is an authorization bypass combined with plaintext credential exposure. The GET endpoints `GET /api/1/destinations` and `GET /api/1/destinations/<id>` in `lemur/destinations/views.py` are protected only by `login_required` (inherited from `AuthenticatedResource`), whereas their write siblings (`POST`/`PUT`/`DELETE`) enforce `@admin_permission.require(http_exception=403)`. The `DestinationOutputSchema` serializes all stored options verbatim, including the SFTP plugin's `password` and `privateKeyPass` fields, which are stored in plaintext in the database. An authenticated attacker—including one with explicit read-only access—can call either read endpoint to retrieve the full option list and extract the plaintext secrets. No user interaction is required, and the attack is fully network-reachable. With these credentials, the attacker can authenticate to the remote SFTP servers and modify or exfiltrate the organization's TLS certificates. The fix requires gating the read endpoints with `admin_permission` and/or redacting secret option values before serialization.
Affected products
- Netflix Lemur < 1.9.3
Timeline
- 2026-07-06: disclosed: Initial disclosure reported to Netflix/Lemur
- 2026-08-18: advisory: GitHub Advisory GHSA-6c8m-q6g9-vrw3 and CVE-2026-71307 published
- 2026: patched: Fixed in Netflix/Lemur v1.9.3