Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
containrrr/watchtower
main @ ca0e86e
3
Fixes
4
CVEs
CRITICAL
Peak severity
Highlights
Information Disclosure: 2 prior fixes. Scrutinize any change in this area.
pkg/registry/auth/auth.go: most-fixed (2 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: An authentication bypass existed in the API token-verification middleware because unauthorized requests were not aborted after a failed validation, potentially exposing API endpoints to unauthenticated actions. Developers must ensure that all authentication failures explicitly abort execution and return a 401 Unauthorized status code.
Information Disclosure: Registry credentials and passwords were leaked into trace-level and debug-level logs via logging utilities. Developers must avoid logging sensitive fields such as raw passwords or authentication tokens in any diagnostics outputs, ensuring complete sanitization or exclusion of credential variables before logging.