CVE-2026-71307: Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Lemur’s destination read endpoints – GET /api/1/destinations and GET /api/1/destinations/<id> – return the full set of stored plugin option values to any authenticated user, with no authorization check and no redaction of secret-bearing options. The sibling write endpoints (POST/PUT/DELETE) are gated with @admin_permission.require(http_exception=403), but the two read handlers are protected only by login_required (inherited from AuthenticatedResource). They do not even exclude read-only users.

The built-in SFTP destination plugin (sftp-destination) stores its password and privateKeyPass options in cleartext in the destinations.options column (the plugin’s own docstring states “Passwords are not encrypted and stored as a plain text.”). Because DestinationOutputSchema serializes every option value verbatim, any authenticated principal – including a read-only user – can retrieve these credentials and use them to authenticate to the remote SFTP server to which Lemur deploys certificates.