Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
smallstep/cli
master @ abd06dc
28
Fixes
10
CVEs
CRITICAL
Peak severity
40.7%
Coverage
Highlights
Auth Bypass: 10 prior fixes. Scrutinize any change in this area.
command/ssh/certificate.go: most-fixed (3 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: OIDC tokens could bypass intended principal restrictions and inherit broader default SSH identity permissions during certificate signing operations. Developers should ensure explicit principal checks are enforced for all external identity tokens.
Signature Validation Bypass: The CLI signed certificate requests (CSRs) without first validating the signature of the request, potentially allowing forged or unauthenticated certificate issuances.
Auth Bypass: A missing signature verification check allowed commands to treat empty inputs as valid, bypassing cryptographic signature validation entirely unless explicit parameter constraints were enforced.