CVE-2026-71307: Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API
Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required adminpermission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allowing even a read-only user to retrieve credentials for remote certificate-deployment hosts. The exposed credentials could permit direct access to SFTP systems and TLS material outside the Lemur security boundary. The fix requires administrator permission for destination reads and redacts options marked sensitive. This issue is fixed in version 1.9.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lemurto a version that resolves this vulnerability.Fixed in 1.9.3 - Configuration
Require administrator permission (admin_permission) for GET /api/1/destinations and GET /api/1/destinations/ so low-privilege authenticated users cannot read plaintext destination credentials.
Lemur destinations API destination reads authorization = admin_permission required - Configuration
Redact options marked sensitive when returning destination details via the destinations API so plaintext SFTP passwords and private-key passphrases/passphrases are not exposed.
Lemur destinations API sensitive option redaction = redact sensitive options
Event History
Frequently Asked Questions
Which deployments and users are exposed?
Lemur deployments prior to 1.9.3 are affected when they have SFTP destinations configured with a password or private-key passphrase. Any authenticated read-only user can request the destination API endpoints and retrieve those values.
What access is required to exploit this issue?
An attacker needs only valid authentication to a low-privilege Lemur account; no administrator permission or user interaction is required. They can use GET /api/1/destinations or GET /api/1/destinations/ to obtain raw destination options containing plaintext SFTP credentials.
What should be done if the issue is identified?
Upgrade Lemur to version 1.9.3, which restricts destination reads to administrators and redacts options marked sensitive. If credentials may have been exposed, rotate the affected SFTP passwords and private-key passphrases because they could allow access to remote certificate-deployment hosts.
How can I determine whether credentials may already be exposed?
Review whether non-administrator accounts can successfully call GET /api/1/destinations or GET /api/1/destinations/ and whether the returned destination options contain password or privateKeyPass values. Also identify SFTP destination configurations that store either value in plaintext.