Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

metalbear-co/mirrord

              main @ 5875242
            

Fixes

CVEs

HIGH

Peak severity

56.3%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

mirrord-intproxy: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Bypasses in file operations allow unauthorized remote access or local-to-remote boundary confusion. Enforcing path canonicalization and strict prefix checks is necessary to protect the local environment.

Privilege Escalation: Deploying agents with fully privileged Kubernetes containers or excessive cluster RBAC permissions poses a severe container escape and cluster compromise risk. Dropping capabilities and replacing impersonation is required.

Auth Bypass: Local Named Pipes on Windows and WebSocket interfaces on localhost can allow local privilege escalation or cross-origin hijacking (CSRF) if DACLs are not restricted to the current user's SID or if Origin headers are unvalidated.