[SECURITY] Fix Auth Bypass & CORS Misconfiguration (V-008, V-009) #63

allegro · 2026-03-30T23:55:01Z

allegro commented

2026-03-30 23:55:01 +00:00

API Server security hardening:

V-009 (CVSS 8.1): Fail-secure default for auth

Deny all requests if no API key configured
Require explicit allow_unauthenticated for local dev

V-008 (CVSS 8.2): Reject CORS wildcard

Block '*' origins (vulnerable with credentials)
Require explicit origin list

Refs: SECURITY_AUDIT_REPORT.md

API Server security hardening: **V-009 (CVSS 8.1)**: Fail-secure default for auth - Deny all requests if no API key configured - Require explicit allow_unauthenticated for local dev **V-008 (CVSS 8.2)**: Reject CORS wildcard - Block '*' origins (vulnerable with credentials) - Require explicit origin list Refs: SECURITY_AUDIT_REPORT.md

allegro added 1 commit 2026-03-30 23:55:02 +00:00

security: fix auth bypass and CORS misconfiguration (V-008, V-009)

Supply Chain Audit / Scan PR for supply chain risks (pull_request) Successful in 27s

Details

Tests / test (pull_request) Failing after 24s

Details

Docker Build and Publish / build-and-push (pull_request) Failing after 35s

Details

cfcffd38ab

API Server security hardening:

V-009 (CVSS 8.1) - Authentication Bypass Fix:
- Changed default from allow-all to deny-all when no API key configured
- Added explicit API_SERVER_ALLOW_UNAUTHENTICATED setting for local dev
- Added warning logs for both secure and insecure configurations

V-008 (CVSS 8.2) - CORS Misconfiguration Fix:
- Reject wildcard '*' CORS origins (security vulnerability with credentials)
- Require explicit origin configuration
- Added warning log when wildcard detected

Changes:
- gateway/platforms/api_server.py: Hardened auth and CORS handling

Refs: V-008, V-009 in SECURITY_AUDIT_REPORT.md
CWE-287: Improper Authentication
CWE-942: Permissive Cross-domain Policy

allegro merged commit 37c5e672b5 into main

2026-03-30 23:55:05 +00:00

allegro referenced this issue from a commit

2026-03-30 23:55:06 +00:00

Merge pull request '[SECURITY] Fix Auth Bypass & CORS Misconfiguration (V-008, V-009)' (#63) from security/fix-auth-bypass into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Timmy_Foundation/hermes-agent#63