CVE-2026-71307: Plaintext Credential Exposure in Netflix Lemur Destinations API

Netflix Lemur is an orchestration engine designed to manage the creation, renewal, and deployment of TLS certificates. To facilitate certificate installation, Lemur relies on destination plugins that automatically push certificates and private keys to target hosting systems. These destinations typically include load balancers, web servers, and remote file systems connected via secure channels.

Prior to version 1.9.3, Lemur suffered from an authorization and sanitization flaw within its destinations resource. The system enforced administrative access controls on state-changing operations, such as creating, updating, or deleting a destination. However, the queries retrieving destination details relied solely on basic user authentication. This lack of restriction meant that any user with a standard, read-only session could access the registration configurations of external deployment endpoints.

Additionally, the serialization logic used to build API responses did not filter the properties passed to clients. For plugins that store credentials locally to authenticate to destination systems, such as the SFTP destination plugin, these configuration parameters were exposed in plaintext. Consequently, low-privilege actors could extract target host passwords and SSH key passphrases from standard API responses.

The vulnerability is a combination of Missing Authorization (CWE-862) and Cleartext Storage of Sensitive Information (CWE-312). The access control gap lies in lemur/destinations/views.py. While POST, PUT, and DELETE handlers for the destinations resource were restricted using decorators that require admin permissions, the GET handlers lacked this enforcement. Standard authenticated sessions, such as those assigned to read-only auditors, were allowed to query the endpoints directly.

The endpoints affected by this authorization gap are:

• GET /api/1/destinations (handled by DestinationsList.get)
• GET /api/1/destinations/<destination_id> (handled by Destinations.get)
• GET /api/1/certificates/<certificate_id>/destinations (handled by CertificateDestinations.get)

The serialization gap resides in lemur/destinations/schemas.py, where Lemur utilizes Marshmallow schemas to validate and serialize data. The DestinationOutputSchema was designed to serialize the data models directly. When building the output, the post-dump hook fill_object would copy options into the pluginOptions dictionary without performing inspection or redaction. If a plugin registered an authentication credential within its options, that credential was passed directly into the serialized JSON payload.

Finally, the SFTP destination plugin (SFTPDestinationPlugin in lemur/plugins/lemur_sftp/plugin.py) defined option parameters such as password and privateKeyPass without marking them as sensitive. Because the core serialization architecture had no mechanism to recognize these fields as confidential, it delivered the plaintext credentials to any authorized API reader.

To resolve the vulnerability, the development team modified both the endpoint access controls and the serialization schemas. In lemur/destinations/views.py, the @admin_permission.require(http_exception=403) decorator was added to all GET methods. This establishes a uniform permission model, ensuring that only administrators can read the destination definitions.

In lemur/destinations/schemas.py, a redaction block was added to the fill_object post-dump processor of the DestinationOutputSchema. This block iterates over the options and sets any option marked as sensitive to None prior to output generation.

# lemur/destinations/schemas.py
class DestinationOutputSchema(LemurOutputSchema):
    @post_dump
    def fill_object(self, data):
        if data:
            # Fixed logic: Redact option values marked as sensitive before serialization
            for option in data.get("options", []):
                if option.get("sensitive"):
                    option["value"] = None
            data["plugin"]["pluginOptions"] = data["options"]
            for option in data["plugin"]["pluginOptions"]:
                if "export-plugin" in option["type"]:
                    pass

The SFTP destination plugin options were also updated to specify the sensitive property:

# lemur/plugins/lemur_sftp/plugin.py
class SFTPDestinationPlugin(DestinationPlugin):
    options = [
        # ... other options ...
        {
            "name": "password",
            "type": "str",
            "required": False,
            "helpMessage": "The SFTP password (optional when the private key is used).",
            "default": None,
            "sensitive": True,
        },
        {
            "name": "privateKeyPass",
            "type": "str",
            "required": False,
            "helpMessage": "The password for the encrypted RSA private key (optional).",
            "default": None,
            "sensitive": True,
        },
    ]

Exploitation of this vulnerability requires an authenticated session with low-privilege access, such as a read-only role or a compromise of a standard API key. The attacker can identify the network coordinates of internal deployment destinations by performing a standard query against the destination API endpoints. Because the GET handlers did not require administrative privileges, the server processed the request and executed the vulnerable serialization schema.

An attacker would perform the following steps:

1. Authenticate to the Lemur instance as a standard user.
2. Query the destinations list:

   GET /api/1/destinations HTTP/1.1
   Host: lemur.internal
   Authorization: Bearer <low_privilege_token>

3. Extract sensitive parameters from the JSON response payload.

An example of the vulnerable JSON output structure showing the exposed credentials before the patch was applied:

{
  "id": 12,
  "label": "prod-sftp-server",
  "options": [
    {"name": "host", "type": "str", "value": "10.10.42.15"},
    {"name": "user", "type": "str", "value": "cert-deployer"},
    {"name": "password", "type": "str", "value": "UnprotectedPassword123", "sensitive": true}
  ]
}

The impact of this vulnerability is significant because Lemur is designed to operate inside a secure network boundary to manage sensitive cryptographic keys. By obtaining the credentials stored within the destination options, an attacker can bypass Lemur's access controls completely. The attacker can use the harvested passwords or key passphrases to establish out-of-band connections directly to the deployment endpoints.

If the deployment endpoints are SFTP servers, the attacker could read or modify sensitive files, including private keys and certificates stored outside Lemur's control. In environments where the same credentials are reused across multiple administrative interfaces, the impact could extend to broader network lateral movement.

The CVSS v3.1 score is calculated as 7.7. The Scope metric is set to Changed (S:C) because compromising the destination credentials allows the attacker to access systems outside of Lemur's application boundaries. Confidentiality is rated High (C:H) due to the direct extraction of raw authentication parameters.

The primary remediation strategy is upgrading Netflix Lemur to version 1.9.3 or higher. This update restricts all GET operations on the destinations endpoint to administrators and implements the schema redaction logic. If an immediate upgrade is not possible, security teams must deploy network-level mitigations or policy changes.

Workarounds include implementing strict URL routing rules at the reverse proxy or Web Application Firewall (WAF) layer. Organizations should block GET requests to /api/1/destinations and /api/1/certificates/*/destinations originating from any user agent or IP address that does not belong to a designated administrative administrator.

Additionally, organizations using custom or proprietary destination plugins must audit their codebase. Any custom options containing API tokens, passwords, or cryptographic key passphrases must have the "sensitive": True property added to their configuration schemas to ensure they are handled properly by the new serialization redaction engine.