Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cockroachdb/cockroach

              master @ 8812064
            

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

.github/workflows/investigate.yml: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The original author_association-based check was insufficient for permission enforcement, allowing unauthorized users to trigger actions. Replaced with API-based collaborator permission check.

Sandbox Escape / Command Injection: Agent could post commands via gh CLI without explicit denial, risking unauthorized comment posting. Fix explicitly denies posting commands and instructs no retry.

Auth Bypass: CVE-2025-9276: empty root password in shadow file allows remote authentication bypass. This is a known published vulnerability in a related component.