Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/mindersec/minder

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.5GoPublished

    Minder does not sandbox http.send in Rego programs

    GHSA-6xvf-4vh9-mw47

    Affected
    • Go github.com/mindersec/minder >= 0.0.72, <= 0.0.83
    Fixed in
    0.0.84· Vendor fix available
    Issue
    Impact Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to (for example, if the Minder server is behind a firewall or other network partition). Patches https://github.com/mindersec/minder/commit/f770400923984649a287d7215410ef108e845af8 Workarounds Users should avoid deploying Minder with access to sensitive resources. Unfortunately, this could include access to systems like OpenFGA or Keycloak, depending on the deployment configuration. References Sample ruletype: Example policy: Evaluation results:

    Recommended action: Upgrade to 0.0.84 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →