Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
amoylab/unla
main @ 96f0bb6
12
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 8 prior fixes. Scrutinize any change in this area.
cmd/apiserver/main.go: most-fixed (2 issues). Treat as high-risk during review.
9 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Sensitive tenant management operations (PUT, DELETE) and entire resource groups (MCP servers) were historically exposed due to missing middleware application and incorrect route registration order. This allows unauthenticated attackers to hijack routes, manipulate configurations, or perform deletions.
SSRF: Outbound requests made via system tools or core HTTP clients allowed access to internal networks. Remediations required implementing host allowlists, DNS pinning, and unmapping IPv4-mapped IPv6 addresses to prevent DNS rebinding bypasses.
Auth Bypass: Flawed OAuth2 authorization code grant implementations permitted token generation without PKCE validation or verification that the requesting client matches the original code owner, enabling authorization hijacking.