Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mindsdb/minds

              main @ 4275a2a
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 19 prior fixes. Scrutinize any change in this area.

mindsdb/api/mysql/mysql_proxy/mysql_proxy.py: most-fixed (12 issues). Treat as high-risk during review.

34 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Critical structural failures in the MySQL proxy authentication flow historically permitted logins with incorrect or entirely empty passwords during the Fast Auth and plugin-switching handshake phases. Incomplete verification states and debug statements allowed connections to complete without proper credential matching.

Auth Bypass: A breakdown in multi-tenant resource isolation allowed operations to run without a validated user or tenant context, because the controller failed to propagate tenant identifiers (`company_id`) downward into downstream components like the Datastore and Model interfaces.

SSRF: Ingestion and URL-based file upload handlers historically allowed Server-Side Request Forgery because they failed to restrict source requests to configured, safe domain list rules, exposing internal infrastructure endpoints to unauthorized web crawling and retrieval.