Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

vespa-engine/vespa

              master @ 8002927
            

144

Fixes

CVEs

HIGH

Peak severity

72.5%

Coverage

Highlights

Auth Bypass: 73 prior fixes. Scrutinize any change in this area.

config-model: most-fixed (18 issues). Treat as high-risk during review.

74 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recurring logical failures in Athenz service instance validation and refresh handlers allowed identity document spoofing and unauthorized certificate registration. Multiple fixes were required to reinstate signature verification and sanitize subject alternative names.

Auth Bypass: Incorrect configuration and premature path-matching optimizations in the HTTP server model led to several filters being bypassed, leaving data-plane endpoints exposed. Key fixes involved securing default routing bindings and preventing response filters from overriding request auth filters.

Auth Bypass: Vespa's custom RPC transport layer (JRT) historically ran with insecure default access control filters (ALLOW_ALL) or skipped validation during TLS handshakes, exposing administrative RPC commands to network users.