Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

paritytech/zombienet

              main @ a7c4342
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

CI/CD Security: 1 prior fix. Scrutinize any change in this area.

CI/CD: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Privilege Escalation: Deploying components with ClusterRoleBinding grants excessive administrative access across the entire cluster, allowing compromised namespaces to manipulate unrelated cluster resources. Developers must restrict access utilizing localized RoleBindings tied to specific namespaces.

Credential Exposure: Integrating third-party automation tokens in workflows triggered by untrusted pull requests from external forks poses a critical secret exposure risk. Workflows requiring privileged tokens like GITSPIEGEL_TOKEN must be isolated via workflow_run triggers or approval gates.

Sandbox Escape: Failing to isolate namespaces properly inside Kubernetes clusters permits containerized jobs to communicate across boundaries, potentially escaping the sandbox. Network policies must explicitly consume dynamic target namespace arguments.