CVE-2026-71307

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3

Description An issue exists where the DestinationOutputSchema returns raw options and copies them into pluginOptions without redacting sensitive values. Specifically, the sftp-destination plugin stores password and privateKeyPass values in plaintext. This allows users with read-only access to retrieve credentials for remote certificate-deployment hosts via the 'GET /api/1/destinations' and 'GET /api/1/destinations/' endpoints, potentially granting direct access to SFTP systems and TLS material outside the security boundary.

Recommendations Update to version 1.9.3.