Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

danswer-ai/danswer

              main @ cbfd6b3
            

223

Fixes

CVEs

CRITICAL

Peak severity

21.9%

Coverage

Highlights

Auth Bypass: 97 prior fixes. Scrutinize any change in this area.

backend/onyx/auth/users.py: most-fixed (20 issues). Treat as high-risk during review.

163 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Numerous fixes in user authentication and account linking show recurring bypasses in OAuth callback, invite verification, and tenant resolution. Attackers could exploit email case sensitivity, missing sso_managed checks, or insecure account claiming to gain unauthorized access.

SSRF: SSRF vulnerabilities were found in multiple outbound HTTP clients, including JWT key fetching, OAuth token refresh, and web connectors. These allow attackers to reach internal services or cloud metadata, potentially leading to credential theft.

Privilege Escalation: The sandbox feature has multiple privilege escalation and credential exposure issues, including running commands as root, leaking API keys/PATs, and missing capability drops. An attacker with code execution in the sandbox could escalate to host access or steal credentials.