Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
falcosecurity/falco
master @ 5123e90
18
Fixes
2
CVEs
HIGH
Peak severity
77.8%
Coverage
Highlights
Denial of Service: 7 prior fixes. Scrutinize any change in this area.
userspace/engine/falco_engine.cpp: most-fixed (3 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Logic flaws in monitoring extraction, such as aborting multi-container JSON array iteration on empty values, can fail to trigger security policies, allowing unauthorized actions to bypass detection.
Privilege Escalation: Mounting host directories like /dev as read-write inside containers allows container escape or disk tampering, necessitating explicit readOnly: true configurations.
Auth Bypass: Overly permissive RBAC configurations (such as cluster-admin bindings or AWS system:masters mappings) violate least privilege principles and grant broad cluster control.