CVE-2026-71307: Netflix Lemur destinations API authorization bypass

CVE-2026-71307 · Severity: high · CVSS 7.7 · Published 2026-08-18

Lemur is a certificate lifecycle management platform used to automate the deployment of TLS certificates across infrastructure. The destinations API—which stores and retrieves credentials for certificate deployment targets (e.g., SFTP servers)—returns plaintext SSH passwords and key passphrases to any authenticated user, including those restricted to read-only access. An attacker with low-privilege Lemur access can enumerate all configured deployment destinations and extract their credentials, then authenticate directly to remote certificate deployment hosts to replace or exfiltrate TLS material.

Technologies: lemur (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-71307 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71307 being exploited in the wild.
How severe is CVE-2026-71307?
High severity, with a CVSS score of 7.7, published 18 August 2026.
Which products and versions are affected?
lemur (PyPI) < 1.9.3, ECOSYSTEM:introduced=0,fixed=1.9.3.
Is there a fix for CVE-2026-71307?
Yes. lemur (PyPI): upgrade to 1.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71307 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-71307?
Check whether you run lemur (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lemur (PyPI): upgrade to 1.9.3 or later
    pip install "lemur>=1.9.3"

Technical details

The vulnerability is an authorization bypass combined with plaintext credential exposure. The GET endpoints `GET /api/1/destinations` and `GET /api/1/destinations/<id>` in `lemur/destinations/views.py` are protected only by `login_required` (inherited from `AuthenticatedResource`), whereas their write siblings (`POST`/`PUT`/`DELETE`) enforce `@admin_permission.require(http_exception=403)`. The `DestinationOutputSchema` serializes all stored options verbatim, including the SFTP plugin's `password` and `privateKeyPass` fields, which are stored in plaintext in the database. An authenticated attacker—including one with explicit read-only access—can call either read endpoint to retrieve the full option list and extract the plaintext secrets. No user interaction is required, and the attack is fully network-reachable. With these credentials, the attacker can authenticate to the remote SFTP servers and modify or exfiltrate the organization's TLS certificates. The fix requires gating the read endpoints with `admin_permission` and/or redacting secret option values before serialization.

Affected products

  • Netflix Lemur < 1.9.3

Identifiers

  • CVE-2026-71307
  • GHSA-6c8m-q6g9-vrw3
  • PYSEC-2026-3674

Timeline

  • 2026-07-06: disclosed: Initial disclosure reported to Netflix/Lemur
  • 2026-08-18: advisory: GitHub Advisory GHSA-6c8m-q6g9-vrw3 and CVE-2026-71307 published
  • 2026: patched: Fixed in Netflix/Lemur v1.9.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.