Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
tracecathq/tracecat
main @ 6c1d4a9
127
Fixes
0
CVEs
CRITICAL
Peak severity
40.5%
Coverage
Highlights
Auth Bypass: 69 prior fixes. Scrutinize any change in this area.
tracecat/auth/users.py: most-fixed (11 issues). Treat as high-risk during review.
77 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Unsigned identity provider assertions and disabled signature verification by default allowed comprehensive authentication bypasses. Hardening defaults to enforce signatures was required across SAML configurations.
Sandbox Escape: Misconfigured container runtimes and bind-mounted host filesystems (such as `/proc`) exposed the host system to compromise. Restricting namespace mounts and adopting nsjail with strict seccomp filtering were required to isolate execution workloads.
Auth Bypass: Unvalidated organizational contexts and weak token verification let users with membership in multiple organizations bypass isolation boundaries to query or modify resources in adjacent workspaces.