EUVD-2026-61153
GHSA-6c8m-q6g9-vrw3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-accessible REST API requires only a valid authenticated session (PR:L, AV:N, AC:L); scope changes (S:C) because leaked SFTP credentials enable access to external certificate-hosting systems beyond Lemur's trust boundary.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4Blast Radius
ecosystem impact- 3 pypi packages depend on lemur (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.9.3.
DescriptionCVE.org
Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allowing even a read-only user to retrieve credentials for remote certificate-deployment hosts. The exposed credentials could permit direct access to SFTP systems and TLS material outside the Lemur security boundary. The fix requires administrator permission for destination reads and redacts options marked sensitive. This issue is fixed in version 1.9.3.
AnalysisAI
Credential exposure in Netflix Lemur's destination API allows any authenticated low-privilege user to retrieve plaintext SFTP passwords and private key passphrases stored in destination plugin configurations. Affected versions prior to 1.9.3 expose GET /api/1/destinations endpoints without the admin_permission guard applied to sibling write handlers, and DestinationOutputSchema serializes raw plugin options - including fields marked as storing passwords - without redaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold any valid Lemur authentication credential - including low-privilege or read-only accounts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Lemur v1.9.3, available at https://github.com/Netflix/lemur/releases/tag/v1.9.3 and confirmed by commit 751c970ec42a53d00ecc9c6a96e0e51b6737ae53. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all low-privilege user access to Lemur destination endpoints by reviewing API logs for GET requests to /api/1/destinations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today