Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

newrelic/newrelic-ruby-agent

              dev @ 7fbf3e0
            

Fixes

CVEs

HIGH

Peak severity

46.4%

Coverage

Highlights

Information Disclosure: 16 prior fixes. Scrutinize any change in this area.

lib/new_relic/agent/configuration/high_security_source.rb: most-fixed (7 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Information Disclosure: High Security Mode (HSM) is intended to be a robust, local-first lock on sensitive data capture. Historically, server-provided settings could override local configurations, and certain instrumentation paths (such as Redis, MongoDB, attributes, and AI monitoring) failed to automatically disable or obfuscate payloads when HSM was active, risking severe leakage of customer database, API, and LLM payloads to New Relic collectors.

Reflected XSS: Browser transaction tokens retrieved from the 'NRAGENT' request cookie (or associated query parameters) were historically rendered directly into views or dashboards without output encoding, opening a vector for reflected Cross-Site Scripting.

Cleartext Transmission of Sensitive Information: The agent previously allowed silent fallbacks to unencrypted HTTP transport or unencrypted gRPC channels when SSL setup failed, opening transactions to network-level interception.