Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
open-policy-agent/gatekeeper
master @ 7b5bb0e
33
Fixes
1
CVEs
HIGH
Peak severity
48.0%
Coverage
Highlights
Auth Bypass: 17 prior fixes. Scrutinize any change in this area.
pkg/webhook/policy.go: most-fixed (5 issues). Treat as high-risk during review.
15 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Validation bypasses occur when the context of the original admission operation (e.g., DELETE) or the initiating identity (such as Gatekeeper service accounts) is not preserved or strictly verified during evaluation. This allows restricted operations to escape policy enforcement.
Auth Bypass: Multi-container validation logic in pod security policy constraints was historically vulnerable to bypasses because the rules checked container-level security contexts or annotations globally instead of strictly validating each individual container.
Denial of Service: Unbounded request volume and lack of thread-safety in webhook operations could cause resource exhaustion or race-condition crashes. Implementations must constrain concurrent request handling using semaphores and lock metrics reporters safely.