Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

crowdsecurity/crowdsec

              master @ cc76dbb
            

Fixes

CVEs

HIGH

Peak severity

31.6%

Coverage

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

cmd/crowdsec-cli/clidecision/import.go: most-fixed (2 issues). Treat as high-risk during review.

16 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple high-severity fixes address bypasses in allowlist checks, machine registration, and JWT token validation, indicating systemic gaps in authorization enforcement across different components.

Authentication Bypass: Fixes target TLS certificate revocation validation and JWT token refresh/invalidation logic, showing recurring weaknesses in authentication path validation and token lifecycle management.

WAF Bypass: Incorrect URI handling and rule generation for multiple zones/operators allowed bypasses, indicating fragile WAF rule construction and request normalization.