Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
archestra-ai/archestra
main @ 253da0f
145
Fixes
0
CVEs
HIGH
Peak severity
36.1%
Coverage
Highlights
Auth Bypass: 87 prior fixes. Scrutinize any change in this area.
platform/backend/src/auth/better-auth.ts: most-fixed (6 issues). Treat as high-risk during review.
81 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Cached connection states for remote MCP servers were shared across different user sessions without verifying credentials, leading to cross-user privilege leakage and unauthorized tool execution.
Auth Bypass: SSO role mapping and registration hooks failed to enforce strict-mode mapping validation or allowed domains under certain conditions, enabling unauthorized sign-ups and stale privilege persistence.
Path Traversal: FileStore local storage operations lacked strict realpath validation and canonical prefix verification, permitting local directory traversals and file escapes.