Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pytorch/serve
master @ 62c4d6a
9
Fixes
5
CVEs
HIGH
Peak severity
22.2%
Coverage
Highlights
Auth Bypass: 4 prior fixes. Scrutinize any change in this area.
frontend/archive: most-fixed (2 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Token authorization was historically disabled by default, exposing both administration and inference APIs. Multiple patches were required to enforce secure defaults and properly prioritize token validation configuration.
Auth Bypass: The gRPC endpoint interface bypassed standard HTTP token authorization checks. A dedicated gRPC interceptor had to be introduced to align access controls and enforce token verification on gRPC requests.
Path Traversal: Insufficient sanitization of model archive names and download paths permitted directory traversal. Attackers could manipulate archive retrieval paths to access restricted locations during registration.