Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
tabbyml/tabby
main @ e8608d6
36
Fixes
4
CVEs
HIGH
Peak severity
40.6%
Coverage
Highlights
Auth Bypass: 19 prior fixes. Scrutinize any change in this area.
ee/tabby-webserver/src/service/auth.rs: most-fixed (10 issues). Treat as high-risk during review.
18 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The authentication service has repeatedly suffered from vulnerabilities enabling unauthorized user creation, local credential overrides of SSO users, and registration without consumption of valid invitations. Ensuring strict verification at these state changes is critical.
Privilege Escalation: JWT claims were previously trusted directly to assert administrative authority (claims.is_admin) without querying the database, allowing privilege escalation. Developers must always validate admin actions directly against the source-of-truth datastore.
Auth Bypass: Worker registration pathways via WebSocket upgrades originally lacked token or authorization checks, allowing arbitrary worker registration to the hub. Every worker registration entry point must validate the token securely.