Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

micrometer-metrics/micrometer

              main @ 16de27b
            

Fixes

CVEs

MEDIUM

Peak severity

100.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

implementations/micrometer-registry-datadog/src/main/java/io/micrometer/datadog/DatadogMeterRegistry.java: most-fixed (2 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Log Injection: Meter names and tag values flow into line-protocol strings without sanitization, enabling CR/LF injection that can spoof or corrupt metrics.

Auth Bypass: API key is cached at startup and reused for all pushes; if the key is rotated or revoked, the registry continues using stale credentials, effectively bypassing auth changes.