High, CVSS 8.7PyPIAmendedPublished
Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset
GHSA-h4g2-xfmw-q2c9
- Affected
- PyPI clauster <= 0.2.1
- Fixed in
- 0.2.2· Vendor fix available
- Issue
- A Clauster instance bound to a non-loopback address (e.g. 0.0.0.0 or a LAN IP) can serve the entire dashboard and its API without any authentication — even when the operator has configured a password — if auth.enabled is left at its default (false). The operator believes the instance is password-protected; in reality every request is served unauthenticated. Impact An unauthenticated attacker with network access to the instance gains full control of the dashboard: list projects, spawn/stop claude remote-control bridges in any project directory, edit CLAUDE.md, read bridge logs, and (where configured) clone repositories. Because bridges run Claude Code against the host's project directories, this is effectively remote code execution in those projects. Loopback (127.0.0.1) deployments need no auth by design and are not affected. Affected configurations All released versions (≤ 0.2.1) where all of the following hold: - host is a non-loopback address, and - auth.passwordrequired:…
Recommended action: Upgrade to 0.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.