Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
elastic/apm-server
main @ 88b56a9
11
Fixes
0
CVEs
HIGH
Peak severity
100.0%
Coverage
Highlights
Auth Bypass: 5 prior fixes. Scrutinize any change in this area.
apmpackage/apm/manifest.yml: most-fixed (1 issue). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Fail-closed gRPC authorization was introduced, but sibling gRPC methods or future additions may not register handlers, leaving them open.
Auth Bypass: Secondary authorization check for agent resources was added; the HTTP agent config path and any alternate API routes may not enforce the same resource-level checks.
Auth Bypass: API key authentication with resource checks was added; other authorization paths (e.g., secret token) may not validate resource scopes equivalently.