Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kairos-io/kairos

              master @ 015f8c6
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

tests/go.mod: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The validation endpoint accepts unvalidated user inputs that are directly resolved as URLs or local file paths via 'http.Get', enabling Server-Side Request Forgery and arbitrary local file disclosure. This can allow attackers to probe internal networks or read sensitive configuration files from the agent host.

Auth Bypass: The use of static, long-lived GCP service account credentials in GitHub Workflows poses a severe risk of credential leakage and subsequent unauthorized cloud access, which was mitigated by migrating to keyless OIDC Workload Identity Federation.

Denial of Service: Outdated transport dependencies in the test module, specifically 'quic-go' and 'libp2p', exposed the project to denial of service vectors, requiring defensive dependency tracking and regular updates.