CVE-2026-71307: CVE-2026-71307: Plaintext Credential Exposure in Netflix Lemur Destinations API

#security #cve #cybersecurity

CVE-2026-71307: Plaintext Credential Exposure in Netflix Lemur Destinations API

Vulnerability ID: CVE-2026-71307
CVSS Score: 7.7
Published: 2026-08-18

An authorization bypass and information disclosure vulnerability in Netflix Lemur before version 1.9.3 allows authenticated, low-privilege users to retrieve raw destination configurations, exposing plaintext credentials such as SFTP passwords and private key passphrases.

TL;DR

Low-privilege users can query Lemur's destination API endpoints to harvest plaintext SFTP passwords and SSH key passphrases due to missing endpoint authorization and lack of output serialization filters.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-862, CWE-312, CWE-200
Attack Vector: Network
CVSS v3.1 Score: 7.7
Exploit Status: PoC Available
CISA KEV Status: No
Scope: Changed

Affected Systems

Netflix Lemur
Lemur: < 1.9.3 (Fixed in: 1.9.3)

Code Analysis

Commit: 751c970

Fix plaintext credential exposure via destinations API (GHSA-6c8m-q6g9-vrw3)

Mitigation Strategies

Upgrade Lemur to version 1.9.3 or higher
Implement path-based authorization blocks at the API gateway or reverse proxy level
Audit custom or third-party destination plugins to ensure sensitive fields are flagged

Remediation Steps:

Identify all deployment destinations configured within the Lemur database.
Apply the Lemur v1.9.3 update.
Rotate passwords and SSH private key passphrases used by existing destination configurations.
Audit access logs for unauthorized GET requests targeting /api/1/destinations prior to patch application.

References

Read the full report for CVE-2026-71307 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community