Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate at lines 109-117 runs. Any holder of a valid Constellation device API key sends x-cosmos-user: admin to a proxied backend; the documented forward-auth integration treats the caller as admin with no JWT cookie, password, or MFA. Preconditions - Cosmos is deployed with Constellation enabled and at least one device enrolled. - Attacker holds a valid x-cstln-auth API key for an enrolled device. - Attacker reaches Cosmos over the Constellation Nebula tunnel. - Target proxy route has AuthEnabled=true; upstream trusts the x-cosmos-user forward-auth header. Details The branch was written for tunneled-cluster traffic where an upstream Cosmos instance has already authenticated the user and signed the…
Recommended action: Upgrade to 0.22.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/azukaar/cosmos-server >= 0.22.18, <= 0.22.18
Fixed in
0.22.19· Vendor fix available
Issue
GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This was confirmed locally by routing a request through the real tokenMiddleware with Authorization: Bearer not-a-real-token. The request returned public Constellation device metadata from a disposable fixture. A missing-header negative control returned 401 Unauthorized, proving the bypass is specifically the acceptance of arbitrary bearer values. Details Source-to-sink path: - src/httpServer.go:690 registers /api/constellation/public-devices on the authenticated admin API router. - src/httpServer.go:815-817 applies SecureAPI(..., public=false, ...), which runs tokenMiddleware. - src/httpServer.go:231-237 only treats Authorization: Bearer cosmos... as a Cosmos API token for validation. Other…
Recommended action: Upgrade to 0.22.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.