Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
spring-cloud/spring-cloud-config
main @ f5a284f
2
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
GoogleSecretManagerEnvironmentRepository: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Clients could bypass authorization boundaries and fetch secrets from unauthorized GCP projects when token validation was disabled, due to a lack of target project ID validation during access strategy execution.
Auth Bypass: The Google Secret Manager backend repository lacked project-level filtering, allowing unauthenticated or unauthorized clients to fetch secrets belonging to arbitrary GCP project IDs when token-mandatory checks were bypassed.