Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
apache/gravitino
main @ fa66e0b
131
Fixes
0
CVEs
CRITICAL
Peak severity
27.8%
Coverage
Highlights
Auth Bypass: 56 prior fixes. Scrutinize any change in this area.
and: most-fixed (5 issues). Treat as high-risk during review.
101 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes added missing authorization annotations or filters to table, namespace, view, function, and metadata operations, indicating a systemic pattern of endpoints being exposed without privilege checks.
Information Disclosure: Multiple fixes address plaintext credential exposure in API responses, logs, and catalog properties, indicating a recurring failure to properly redact or mask sensitive configuration keys across different object types and serialization paths.
Remote Code Execution / Code Injection: Multiple critical/high fixes block unsafe JDBC URL parameters, driver classes (H2), and DBCP2 properties that enable deserialization-based code execution. This is the project's most severe recurrent risk surface.