mirror of
https://github.com/vxcontrol/pentagi.git
synced 2026-07-21 08:15:23 -04:00
[GH-ISSUE #101] [Bug]: Security issues #57
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @aliuyar1234 on GitHub (Feb 17, 2026).
Original GitHub issue: https://github.com/vxcontrol/pentagi/issues/101
Originally assigned to: @asdek on GitHub.
Affected Component
Core Services (Frontend UI/Backend API)
Describe the bug
Critical: default admin credentials are documented and seeded
README.md:651, backend/migrations/sql/20241026_115120_initial_state.sql:85, backend/migrations/
sql/20241026_115120_initial_state.sql:87
Impact: fresh/unchanged deployments are immediately takeable.
Note: password_change_required is seeded true (backend/migrations/sql/20241026_115120_initial_state.sql:92) but
backend login does not enforce it server-side (backend/pkg/server/services/auth.go:101, backend/pkg/server/
services/auth.go:115, backend/pkg/server/services/auth.go:121), while frontend does client-side handling (frontend/
src/providers/user-provider.tsx:155).
2. Critical: container-to-host boundary is weak in common configs
docker-compose.yml:144, docker-compose.yml:148, backend/pkg/docker/
client.go:267, .env.example:157, .env.example:158, .env.example:159
Impact: app/container compromise can become host Docker daemon control, then host takeover.
3. Critical: user task input can drive arbitrary Docker image execution
backend/pkg/templates/prompts/image_chooser.tmpl:10, backend/pkg/providers/providers.go:336, backend/pkg/tools/
tools.go:388, backend/migrations/sql/20241215_132209_new_user_role.sql:14
Impact: authenticated users can steer runtime image selection; with weak isolation this is a high-risk RCE path.
4. High: OAuth auto-provisions active accounts without allowlist/invite gate
backend/pkg/server/services/auth.go:507, backend/pkg/server/services/auth.go:509, backend/pkg/server/services/
auth.go:511
Impact: if OAuth is enabled on an internet-facing instance, account creation surface is broad.
5. High: OAuth callback GET path does not validate returned state against request
backend/pkg/server/services/auth.go:314, backend/pkg/server/services/auth.go:321, backend/pkg/server/services/
auth.go:333 vs POST check at backend/pkg/server/services/auth.go:370
Impact: weaker CSRF/login integrity on GET callback path.
6. High: session expiry not enforced in auth middleware
backend/pkg/server/auth/auth_middleware.go:91, backend/pkg/server/auth/auth_middleware.go:111; expiry check exists
only in /info flow (backend/pkg/server/services/auth.go:735)
Impact: replay window may exceed intended session timeout semantics.
7. Medium: cookie hardening gaps
backend/pkg/server/services/auth.go:156, backend/pkg/server/services/auth.go:159, backend/pkg/server/services/
auth.go:196, backend/pkg/server/services/auth.go:199, backend/pkg/server/services/auth.go:547, backend/pkg/server/
services/auth.go:550
Impact: no explicit SameSite; Secure depends on TLS detection and can misbehave behind some proxy setups.
8. Medium: request-triggerable panic in OAuth state parser
backend/pkg/server/services/auth.go:600, backend/pkg/server/services/auth.go:601
Impact: malformed short state can panic this request path (DoS-class bug).
9. Medium: browser tool disables TLS verification and has no client timeout
backend/pkg/tools/browser.go:401, backend/pkg/tools/browser.go:402, backend/pkg/tools/browser.go:404, backend/pkg/
tools/browser.go:412
Impact: MITM exposure + hanging request/resource exhaustion risk.
10. Medium: unbounded memory usage paths
backend/pkg/tools/terminal.go:197, backend/pkg/tools/terminal.go:279, backend/pkg/tools/browser.go:412
Impact: memory DoS via large outputs/files/responses.
11. Medium: authorization string typos in permission checks
backend/pkg/server/services/users.go:184, backend/pkg/server/services/users.go:321, backend/pkg/server/services/
users.go:432, backend/pkg/server/services/users.go:519, backend/pkg/server/services/roles.go:66
Impact: access-control logic drift (likely unintended deny behavior and brittle security policy).
12. Low/Medium: inconsistent password policy enforcement
Weak policy in user create/edit model (backend/pkg/server/models/users.go:103) vs strong policy only in current-
user password change (backend/pkg/server/models/users.go:168).
13. Conditional risk: permissive origin handling when * is used
backend/pkg/config/config.go:46, backend/pkg/server/router.go:143, backend/pkg/server/router.go:145, backend/pkg/
server/services/graphql.go:173, backend/pkg/server/services/graphql.go:181
Impact: broad cross-origin surface if deployed with wildcard origins.
Most likely compromise chain in a weak deployment:
docker/client.go:267).
Steps to Reproduce
Analyse the codebase
System Configuration
Windows
Logs and Artifacts
No response
Screenshots or Recordings
No response
Verification
@Muitamax commented on GitHub (Feb 23, 2026):
Remove seeded default password entirely
Require bootstrap token on first run
Enforce password_change_required server-side
Block all other actions until password changed
Strict allowlist of images
Disallow user-provided arbitrary image names
Validate image digests
No dynamic image pulling from user input