Authentication Flaw in Lemur TLS Certificate Management by Netflix

CVE-2026-71307

What is CVE-2026-71307?

Lemur, a tool for managing TLS certificate creation, has an authentication vulnerability prior to version 1.9.3. The issue arises because certain API endpoints rely solely on authentication without enforcing adequate permissions, thus allowing unauthorized access to sensitive data. Specifically, the sftp-destination plugin exposes passwords and privateKeyPass values in plaintext to users with even read-only access. This flaw could lead to unauthorized access to SFTP systems and sensitive TLS materials. The vulnerability has been addressed in version 1.9.3, which now requires administrator permissions for destination reads and appropriately redacts sensitive configuration options.

References