Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
allegroai/clearml-server
master @ 2ebdc43
16
Fixes
1
CVEs
CRITICAL
Peak severity
53.3%
Coverage
Highlights
Auth Bypass: 8 prior fixes. Scrutinize any change in this area.
apiserver/mongo/initialize/user.py: most-fixed (2 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The MongoDB user initialization process has repeatedly suffered from bugs that inadvertently reset or modified active user credentials on server restart instead of isolating internal system accounts.
Auth Bypass: Weaknesses in JWT processing allowed potential key confusion attacks, requiring the enforcement of explicit HS256 algorithm whitelisting during token decoding.
Broken Access Control: Endpoints exposing internal authentication tokens (such as get_token_for_user) lacked strict role-based and identity validation checks, enabling direct vertical privilege escalation.