Most recent entries from all

EUVD-2026-355207

fkie_cve-2026-71307

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allowing even a read-only user to retrieve credentials for remote certificate-deployment hosts. The exposed credentials could permit direct access to SFTP systems and TLS material outside the Lemur security boundary. The fix requires administrator permission for destination reads and redacts options marked sensitive. This issue is fixed in version 1.9.3.

GHSA-6c8m-q6g9-vrw3 — Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passph…

Affected: PyPI: lemur

### Summary Lemur's destination read endpoints -- `GET /api/1/destinations` and `GET /api/1/destinations/<id>` -- return the full set of stored plugin option values to any authenticated user, with no authorization check and no redaction of secret-bearing options. The sibling write endpoints (`POST`/`PUT`/`DELETE`) are gated with `@admin_permission.require(http_exception=403)`, but the two read handlers are protected only by `login_required` (inherited from `AuthenticatedResource`). They do not even exclude `read-only` users.

The built-in SFTP destination plugin (`sftp-destination`) stores its `password` and `privateKeyPass` options in cleartext in the `destinations.options` column (the plugin's own docstring states "Passwords are not encrypted and stored as a plain text."). Because `DestinationOutputSchema` serializes every option value verbatim, any authenticated principal -- including a `read-only` user -- can retrieve these credentials and use them to authenticate to the remote SFTP server to which Lemur deploys certificates.

### Details Read endpoints lack the authorization that their write siblings enforce:

`lemur/destinations/views.py` ```python class DestinationsList(AuthenticatedResource): @validate_schema(None, destinations_output_schema) def get(self): # <-- only login_required; no admin/read-only gate ... return service.render(args)

@validate_schema(destination_input_schema, destination_output_schema) @adm…

PYSEC-2026-3674 — Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passph…

Affected: PyPI: lemur

### Details Read endpoints lack the authorization that their write siblings enforce:

@validate_schema(destination_input_schema, destination_output_schema) @adm…