{"vulnerability": "ghsa-6c8m-q6g9-vrw3", "sightings": [{"uuid": "a6445550-272c-483e-9cc5-f5e11b533ff5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6c8m-q6g9-vrw3", "type": "seen", "source": "https://bsky.app/profile/kyisaiah47.kynth.studio/post/3mtfkonbzug2c", "content": "https://github.com/advisories/GHSA-6c8m-q6g9-vrw3", "creation_timestamp": "2026-08-19T01:17:04.592720Z"}, {"uuid": "d14e306d-81d7-4679-8e8d-c3e17ee3ba95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6c8m-q6g9-vrw3", "type": "seen", "source": "https://gist.github.com/alon710/d3bb7a8e835fd653e6c886cd85f28aa2", "content": "# CVE-2026-71307: CVE-2026-71307: Plaintext Credential Exposure in Netflix Lemur Destinations API\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-08-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71307\n\n## Summary\nAn authorization bypass and information disclosure vulnerability in Netflix Lemur before version 1.9.3 allows authenticated, low-privilege users to retrieve raw destination configurations, exposing plaintext credentials such as SFTP passwords and private key passphrases.\n\n## TL;DR\nLow-privilege users can query Lemur's destination API endpoints to harvest plaintext SFTP passwords and SSH key passphrases due to missing endpoint authorization and lack of output serialization filters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862, CWE-312, CWE-200\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.7\n- **Exploit Status**: PoC Available\n- **CISA KEV Status**: No\n- **Scope**: Changed\n\n## Affected Systems\n\n- Netflix Lemur\n- **Lemur**: < 1.9.3 (Fixed in: `1.9.3`)\n\n## Mitigation\n\n- Upgrade Lemur to version 1.9.3 or higher\n- Implement path-based authorization blocks at the API gateway or reverse proxy level\n- Audit custom or third-party destination plugins to ensure sensitive fields are flagged\n\n**Remediation Steps:**\n1. Identify all deployment destinations configured within the Lemur database.\n2. Apply the Lemur v1.9.3 update.\n3. Rotate passwords and SSH private key passphrases used by existing destination configurations.\n4. Audit access logs for unauthorized GET requests targeting /api/1/destinations prior to patch application.\n\n## References\n\n- [Fix Plaintext Credential Exposure Commit](https://github.com/Netflix/lemur/commit/751c970ec42a53d00ecc9c6a96e0e51b6737ae53)\n- [GitHub Security Advisory GHSA-6c8m-q6g9-vrw3](https://github.com/Netflix/lemur/security/advisories/GHSA-6c8m-q6g9-vrw3)\n- [NVD - CVE-2026-71307](https://nvd.nist.gov/vuln/detail/CVE-2026-71307)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71307) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T06:44:38.224878Z"}]}