Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

smartcontractkit/chainlink

              develop @ 1a9cca6
            

156

Fixes

CVEs

HIGH

Peak severity

28.6%

Coverage

Highlights

Auth Bypass: 65 prior fixes. Scrutinize any change in this area.

core/capabilities/vault: most-fixed (13 issues). Treat as high-risk during review.

79 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The Vault capability has faced persistent authorization issues, including JWT replay validation discrepancies during the leeway window, lack of secret owner validation, and build-mode bypasses in staging environments. Ensuring that secret identifiers belong exclusively to authenticated workflow owners is critical to preventing cross-tenant data exposure.

Auth Bypass: Enclave execution environments within the confidential relay previously failed to enforce presence of attested configuration and did not validate the config against the on-chain Decentralized Oracle Network (DON) state. This allowed malicious hosts to fake enclave settings or bypass signature checks.

Denial of Service: Resource exhaustion during syncer updates occurred due to missing size limits on fetched artifacts, exposing nodes to memory exhaustion. Strict limits on file sizes and artifact configurations are necessary to secure execution paths against malicious inputs.