Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

manaflow-ai/cmux

              main @ 5415a2d
            

295

Fixes

CVEs

CRITICAL

Peak severity

28.1%

Coverage

Highlights

Auth Bypass: 97 prior fixes. Scrutinize any change in this area.

cmux-tui/crates/chatmux-relay/src/session.rs: most-fixed (13 issues). Treat as high-risk during review.

178 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address authorization bypasses in the relay session, including unsolicited trust acknowledgements, workspace observe flag desynchronization, and stale session records. These indicate a fragile trust-state machine where a remote peer can inject or desynchronize state to gain unauthorized access.

Denial of Service: The relay session has been the target of a large number of DoS fixes, all centered on unbounded outbound queues, byte accounting leaks, and blocking sends. This indicates a core design flaw where a remote client can exhaust memory or stall the session by flooding frames or exploiting accounting races.

Auth Bypass: A cluster of fixes target authorization bypasses in mobile attach tickets, specifically missing workspace and terminal scope enforcement, expired ticket acceptance, and parameter alias bypasses. This indicates a high-risk area where a ticket's intended scope is not consistently enforced across all RPC methods.