High, CVSS 7.1GoPublished
Curio exposes database credentials to users with network access through verbose HTTP error responses
GHSA-gj6x-q8rh-wj6x
- Affected
- Go github.com/filecoin-project/curio >= 1.24.3, <= 1.27.2
- Fixed in
- 1.27.3-rc2· Vendor fix available
- Issue
- Multiple HTTP handlers in Curio passed raw database error messages to HTTP clients via http.Error(). When the PostgreSQL/YugabyteDB driver (pgx) returned errors, these could contain the database connection string — including hostname, port, username, and password. Additionally, the internal connection string was constructed with the plaintext password embedded in the URL, which was also included in startup error messages and could surface in logs. Details Three components were affected: 1. PDP handlers (pdp/handlers.go) — 18+ HTTP error paths passed err.Error() directly to HTTP responses. While these endpoints require ECDSA JWT authentication, an authenticated client (e.g., a FilPay service) that triggered a database error would receive the raw pgx error in the HTTP response body. Present since PDP was introduced in v1.25.1. 2. Market mk12 deal status (market/mk12/mk12utils.go) — The GetDealStatus handler included err.Error() in error responses: "failed to query the db for…
Recommended action: Upgrade to 1.27.3-rc2 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.