Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

korotovsky/slack-mcp-server

              master @ b88c0de
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

pkg/provider/api.go: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: A logic inversion in the channel authorization check (isChannelAllowedForConfig) incorrectly processed allowlist and blocklist configurations, allowing unlisted or blocked channels to be accessed.

Auth Bypass: Resource endpoints for channels and users exposed over SSE transport lacked mandatory authentication checks, allowing unauthenticated clients to fetch sensitive Slack resource data.

Auth Bypass: The SSE server transport checked against a generic, potentially empty API_KEY environment variable instead of the dedicated SLACK_SSE_API_KEY, resulting in silent authentication bypasses when unset.