Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gravitational/teleport
master @ 26f257c
253
Fixes
7
CVEs
CRITICAL
Peak severity
33.3%
Coverage
Highlights
Auth Bypass: 168 prior fixes. Scrutinize any change in this area.
lib/auth: most-fixed (37 issues). Treat as high-risk during review.
136 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Critical administrative capabilities and certificate generation endpoints (GenerateUserCerts) repeatedly bypassed administrative Multi-Factor Authentication (MFA) or failed to validate constraints against the target user identity rather than the caller. This allowed privilege escalation across users or cluster configurations.
Auth Bypass: The Kubernetes proxy forwarder has consistently suffered from missing RBAC validation checks for subresources, namespace-scoped custom resources, and incoming identity configurations, allowing unauthorized cluster access or bypassing moderated session rules.
Auth Bypass: MFA enforcement and session joining verification were historically bypassed because the application server relied on insecure client-side assertions or failed to evaluate active locks directly inside the central Authorize routines.