Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mlco2/codecarbon

              master @ 11374f4
            

Fixes

CVEs

CRITICAL

Peak severity

42.9%

Coverage

Highlights

Auth Bypass: 9 prior fixes. Scrutinize any change in this area.

carbonserver/carbonserver/api/routers: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The backend previously bypassed identity-provider signature verification when decoding Fief JWT tokens. This allowed potential token forgery unless signatures and token validity are explicitly verified against the identity server before decoding.

Auth Bypass: API routes managing project tokens, emissions, and runs failed to validate that the caller's organization/user context had authority over the target project ID, permitting unauthorized cross-tenant operations.

Auth Bypass: Listing organizations did not enforce database-level filters or membership joins, allowing authenticated users to list and access records of organizations they did not belong to.