Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

edgexfoundry/edgex-go

              main @ d60d281
            

Fixes

CVEs

CRITICAL

Peak severity

62.9%

Coverage

Highlights

Auth Bypass: 18 prior fixes. Scrutinize any change in this area.

cmd/security-secretstore-setup: most-fixed (3 issues). Treat as high-risk during review.

23 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: The system executor was vulnerable to command injection via shell argument injection from unvalidated command-line parameters. Developers must ensure that parameters are never directly concatenated or execution contexts dynamically modified.

Auth Bypass: Consul registry APIs and Redis databases were historically initialized without ACL protection or starting with a bootstrap window open to unauthenticated users, which allowed unauthorized access. Enforcing default deny policies and pre-authenticated startup configurations is essential.

Auth Bypass: The Kong Admin API was exposed without proper loopback validation and token authentication. Restricting bindings to localhost and enforcing JWT/ACL controls is required to protect the administration interface.