Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zentralopensource/zentral

              main @ 6f367f2
            

Fixes

CVEs

CRITICAL

Peak severity

20.6%

Coverage

Highlights

Auth Bypass: 31 prior fixes. Scrutinize any change in this area.

constraints.txt: most-fixed (24 issues). Treat as high-risk during review.

52 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Privilege Escalation: Multiple fixes show a recurring pattern where non-superusers with partial permissions could mint or extend credentials for privileged service accounts. The can_issue_credentials_for() check was added to several paths, indicating the guard was missing on multiple entry points.

Auth Bypass: A large cluster of fixes added RBAC permission checks to DRF views and various API endpoints, indicating that authorization was inconsistently enforced across the API surface. The PBAC authorize_request check in drf.py is the central guard, but sibling endpoints in inventory, monolith, santa, and osquery needed individual fixes.

Authentication Bypass: Realm authentication flows had critical JWT validation weaknesses (insecure josepy, missing algorithm allowlist) and CSRF/login-flow issues (unverified state, IdP-initiated logins). These fixes show that the realm login paths are a high-risk surface for authentication bypass.