{"vulnerability": "cve-2026-7130", "sightings": [{"uuid": "4b34c596-c0d6-479e-aef4-d56543237982", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71309", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-45pq-889g-fcgh", "content": "", "creation_timestamp": "2026-08-05T22:35:42.471241Z"}, {"uuid": "a857993b-8465-4020-aabe-4456d74b14e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71308", "type": "published-proof-of-concept", "source": "https://github.com/Netflix/lemur/security/advisories/GHSA-cfh6-pv5c-38jv", "content": "", "creation_timestamp": "2026-08-18T22:35:09.557316Z"}, {"uuid": "939db376-7678-455c-b252-7afd61c66a64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71307", "type": "published-proof-of-concept", "source": "https://github.com/Netflix/lemur/security/advisories/GHSA-6c8m-q6g9-vrw3", "content": "", "creation_timestamp": "2026-08-18T22:35:11.782679Z"}, {"uuid": "ea2a446f-4a4d-4f05-8374-3c3548c87efe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71303", "type": "published-proof-of-concept", "source": "https://github.com/Netflix/lemur/security/advisories/GHSA-v5rc-cpwc-cfpr", "content": "", "creation_timestamp": "2026-08-18T22:35:14.194889Z"}, {"uuid": "91804b48-2a50-46af-9179-4706e54a7729", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71308", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mtfky2ijcb2v", "content": "CVE-2026-71308 affects Lemur\u2019s certificate create and upload endpoints: unchecked replaces[] references can disable notifications and auto-reissue for certificates the caller does not own. #software", "creation_timestamp": "2026-08-19T01:22:20.664809Z"}, {"uuid": "7a91f45a-2239-40c6-a999-cd46a9658f85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71307", "type": "seen", "source": "https://gist.github.com/alon710/d3bb7a8e835fd653e6c886cd85f28aa2", "content": "# CVE-2026-71307: CVE-2026-71307: Plaintext Credential Exposure in Netflix Lemur Destinations API\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71307\n\n## Summary\nAn authorization bypass and information disclosure vulnerability in Netflix Lemur before version 1.9.3 allows authenticated, low-privilege users to retrieve raw destination configurations, exposing plaintext credentials such as SFTP passwords and private key passphrases.\n\n## TL;DR\nLow-privilege users can query Lemur's destination API endpoints to harvest plaintext SFTP passwords and SSH key passphrases due to missing endpoint authorization and lack of output serialization filters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862, CWE-312, CWE-200\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.7\n- **Exploit Status**: PoC Available\n- **CISA KEV Status**: No\n- **Scope**: Changed\n\n## Affected Systems\n\n- Netflix Lemur\n- **Lemur**: < 1.9.3 (Fixed in: `1.9.3`)\n\n## Mitigation\n\n- Upgrade Lemur to version 1.9.3 or higher\n- Implement path-based authorization blocks at the API gateway or reverse proxy level\n- Audit custom or third-party destination plugins to ensure sensitive fields are flagged\n\n**Remediation Steps:**\n1. Identify all deployment destinations configured within the Lemur database.\n2. Apply the Lemur v1.9.3 update.\n3. Rotate passwords and SSH private key passphrases used by existing destination configurations.\n4. Audit access logs for unauthorized GET requests targeting /api/1/destinations prior to patch application.\n\n## References\n\n- [Fix Plaintext Credential Exposure Commit](https://github.com/Netflix/lemur/commit/751c970ec42a53d00ecc9c6a96e0e51b6737ae53)\n- [GitHub Security Advisory GHSA-6c8m-q6g9-vrw3](https://github.com/Netflix/lemur/security/advisories/GHSA-6c8m-q6g9-vrw3)\n- [NVD - CVE-2026-71307](https://nvd.nist.gov/vuln/detail/CVE-2026-71307)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71307) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T06:44:38.151816Z"}, {"uuid": "b9f8509a-a65a-4d38-804e-04c64d600e90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71308", "type": "seen", "source": "https://gist.github.com/alon710/efd05c94aa8a7f9db39650de6553e415", "content": "# CVE-2026-71308: CVE-2026-71308: Missing Authorization and Lifecycle Hijacking in Netflix Lemur\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71308\n\n## Summary\nNetflix Lemur before 1.9.3 contains a missing authorization vulnerability (CWE-862, CWE-639) when handling certificate creation, upload, or modification. Authenticated non-read-only users can manipulate the replaces parameter to silence expiration notifications and hijack certificate rotation tasks for arbitrary targets, leading to unauthorized TLS certificate deployment and traffic interception.\n\n## TL;DR\nMissing authorization in Netflix Lemur's certificate replacement logic allows standard users to hijack TLS certificate rotation and silence expiration alerts.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 / CWE-639\n- **Attack Vector**: Network (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)\n- **CVSS Score**: 8.1 (High)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Netflix Lemur\n- **Lemur**: >= 0.5.0, < 1.9.3 (Fixed in: `1.9.3`)\n\n## Mitigation\n\n- Upgrade Netflix Lemur to version 1.9.3 or higher\n- Restrict standard user access to certificate write and edit endpoints\n- Regularly audit active certificate replaces relationships in the Lemur database\n\n**Remediation Steps:**\n1. Identify and catalog all active Netflix Lemur deployments\n2. Apply the security update to upgrade Lemur to version 1.9.3\n3. Verify that current user accounts follow the principle of least privilege\n4. Execute database queries to audit historical replacements for unauthorized mapping configurations\n\n## References\n\n- [Netflix Lemur Authorization Fix Commit](https://github.com/Netflix/lemur/commit/286874535160952143b0afe2d356642669f9d4c6)\n- [Netflix Lemur Release Tag v1.9.3](https://github.com/Netflix/lemur/releases/tag/v1.9.3)\n- [GitHub Security Advisory GHSA-cfh6-pv5c-38jv](https://github.com/Netflix/lemur/security/advisories/GHSA-cfh6-pv5c-38jv)\n- [NVD CVE-2026-71308 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-71308)\n- [CVE Program CVE-2026-71308 Record](https://www.cve.org/CVERecord?id=CVE-2026-71308)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71308) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T06:44:38.271493Z"}, {"uuid": "50a91dc6-4ade-40ba-b988-c8c7c817561d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71303", "type": "seen", "source": "https://gist.github.com/alon710/048e89a8b6d23388e5627d9e6207e2ad", "content": "# CVE-2026-71303: CVE-2026-71303: Server-Side Request Forgery Bypass in Netflix Lemur Authority Updates\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71303\n\n## Summary\nNetflix Lemur, an open-source TLS certificate management framework, is affected by a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability arises from an incomplete patch for a previous security flaw, CVE-2026-55166. While Lemur version 1.9.2 validated the ACME directory URL against an allowlist during authority creation, it failed to perform the same checks when updating existing authorities. An authenticated user possessing an authority role can exploit this omission to replace the directory URL with internal or cloud metadata endpoints. During subsequent certificate issuance, the Lemur backend executes unauthorized requests, potentially leaking sensitive metadata or credentials.\n\n## TL;DR\nAn incomplete patch in Netflix Lemur allows users with authority roles to bypass host allowlists. By submitting a crafted PUT request, attackers can overwrite the ACME directory URL with internal IP addresses, causing the Lemur backend to perform unauthorized outbound connections.\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS Severity**: 7.7 High\n- **EPSS Score**: Not Calculated\n- **Impact**: Server-Side Request Forgery leading to unauthorized internal access or credential leakage\n- **Exploit Status**: No public weaponized exploits available\n- **KEV Status**: Not listed in CISA KEV Catalog\n\n## Affected Systems\n\n- Netflix Lemur certificate management environments deployed prior to version 1.9.3\n- **Lemur**: < 1.9.3 (Fixed in: `1.9.3`)\n\n## Mitigation\n\n- Upgrade Netflix Lemur to version 1.9.3 or newer to ensure all authority modifications are validated\n- Implement host-level iptables or routing rules to block outgoing traffic to 169.254.169.254 from the Lemur application process\n- Enforce AWS IMDSv2 with a hop limit of 1 to prevent metadata access from application runtimes\n- Restrict outbound API network access to known, trusted external ACME directory domains via firewalls or security groups\n\n**Remediation Steps:**\n1. Locate the current Lemur installation path and verify the active version\n2. Retrieve the updated code from the official repository or package manager for version 1.9.3\n3. Apply database migrations and restart the Lemur application services\n4. Review user role permissions to ensure only administrative accounts can modify ACME authorities\n\n## References\n\n- [GitHub Security Advisory GHSA-v5rc-cpwc-cfpr](https://github.com/Netflix/lemur/security/advisories/GHSA-v5rc-cpwc-cfpr)\n- [Netflix Lemur Fix Commit edca0390f930344d65ff4ca37a669c2320e3dfad](https://github.com/Netflix/lemur/commit/edca0390f930344d65ff4ca37a669c2320e3dfad)\n- [Netflix Lemur Release Tag v1.9.3](https://github.com/Netflix/lemur/releases/tag/v1.9.3)\n- [GitHub Security Advisory GHSA-v2wp-frmc-5q3v (CVE-2026-55166)](https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v)\n- [CVE-2026-71303 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71303)\n- [NVD Vulnerability Details for CVE-2026-71303](https://nvd.nist.gov/vuln/detail/CVE-2026-71303)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71303) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T07:31:59.312100Z"}, {"uuid": "d2763d2d-3091-4f61-b08a-f16b941c7114", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71300", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/cr2kets3zyc5l", "content": "CVE-2026-71300: Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection", "creation_timestamp": "2026-08-24T18:28:29.149513Z"}, {"uuid": "7d561eee-7d1d-4c29-b290-eb547d26151b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71300", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtwnvxafw625", "content": "CVE-2026-71300 - apache camel\nOlder versions of Apache Camel that handle WebSocket connections let outside data decide which client receives a message. An attacker could hide a notification or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachecamel #apachefoundation #CVE #infosec", "creation_timestamp": "2026-08-25T20:30:06.196507Z"}, {"uuid": "7cbf6d5a-297f-4e1f-a3e0-e0a414357ad0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71300", "type": "seen", "source": "Telegram/_8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4", "content": "", "creation_timestamp": "2026-08-24T21:00:04.042725Z"}, {"uuid": "1d21b9e6-c5d7-422b-875d-2ede1588ef84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71300", "type": "published-proof-of-concept", "source": "Telegram/_8ioC0-GS3hqaK0vZF92ZaP06wwac1xjhQxJkXlFfEhMVG4", "content": "", "creation_timestamp": "2026-08-25T00:00:10.150548Z"}]}