Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. Affected Component - File: internal/hub/api.go, lines 283–361 - Endpoints: - GET /api/beszel/containers/logs?system=SYSTEMID&container=CONTAINERID - GET /api/beszel/containers/info?system=SYSTEMID&container=CONTAINERID - GET /api/beszel/systemd/info?system=SYSTEMID&service=SERVICENAME - POST /api/beszel/smart/refresh?system=SYSTEMID - Commit: c7261b56f1bfb9ae57ef0856a0052cabb2fd3b84 Vulnerable Code The…
Recommended action: Upgrade to 0.18.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The hub's authenticated API endpoints GET /api/beszel/containers/logs and GET /api/beszel/containers/info pass the user-supplied "container" query parameter to the agent without validation. The agent constructs Docker Engine API URLs using fmt.Sprintf with the raw value instead of url.PathEscape(). Since Go's http.Client does not sanitize ../ sequences from URL paths sent over unix sockets, an authenticated user (including readonly role) can traverse to arbitrary Docker API endpoints on agent hosts, exposing sensitive infrastructure details. Details Hub (internal/hub/hub.go:407-426): containerID from query param is only checked for emptiness, no format validation: Agent (agent/docker.go:651-652 and 682-683): raw containerID interpolated into Docker API URL: Go's http.Client preserves ../ in paths over unix sockets (verified with test code). The Docker daemon resolves them via cleanPath, routing the request to unintended API endpoints. PoC Tested on Beszel v0.18.3 with hub and…
Recommended action: Upgrade to 0.18.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.