CVE-2026-71307 Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API
Authenticated low-privilege users can read plaintext SFTP credentials via the destinations API, potentially exposing remote system access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71307?
CVE-2026-71307 is a high-severity vulnerability in Netflix lemur, published on 18 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allowing even a read-only user to retrieve credentials for remote certificate-deployment hosts. The exposed credentials could permit direct access to SFTP systems and TLS material outside the Lemur security boundary. The fix requires administrator permission for destination reads and redacts options marked sensitive. This issue is fixed in version 1.9.3.
Weakness: CWE-862
Which versions are affected by CVE-2026-71307?
3 open source packages ship an affected version, including lemur.
| Package | Affected | Fixed in |
|---|---|---|
lemur PyPI | All versions | 1.9.3 |
lemur PyPI | All versions | 1.9.3 |
lemur PyPI | All versions | 1.9.3 |
How do I fix CVE-2026-71307?
Upgrade lemur to 1.9.3 or later.
Is CVE-2026-71307 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71307 exists.
Sources
Also known as GHSA-6c8m-q6g9-vrw3, PYSEC-2026-3674.