Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kafbat/kafka-ui

              main @ fa485c2
            

Fixes

CVEs

CRITICAL

Peak severity

54.3%

Coverage

Highlights

Auth Bypass: 25 prior fixes. Scrutinize any change in this area.

LdapSecurityConfig.java: most-fixed (3 issues). Treat as high-risk during review.

29 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes show inconsistent permission requirements for connector operations (restart, delete, view/edit), leading to unauthorized actions. Granular connector-level permissions were needed to replace broader connect-level checks.

Auth Bypass: Null clusters/subjects, empty subject lists, and null value patterns repeatedly bypassed permission checks. Fixes required explicit null/empty validation and fail-closed behavior.

Auth Bypass: Role extraction from external identity providers was repeatedly incorrect (case sensitivity, group mapping, missing teams), allowing unauthorized role assignment.