Skip to content

Argus 1.6.5 — worker authentication security patch

Latest
Latest

Choose a tag to compare

View all tags
@Khamel83 Khamel83 released this 22 Oct 07:02
v1.6.5
f0386c7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security patch for legacy egress workers (argus worker).

  • Require a nonblank ARGUS_EGRESS_SHARED_SECRET at startup and validate the bearer token before every /exec dispatch, including on loopback.
  • Require explicit ARGUS_ENV=development for legacy worker startup. Production execution remains owned by the HTTP authority.
  • Default the worker bind to 127.0.0.1:8273.
  • Clarify security/setup documentation and enable private vulnerability reporting.

Previous versions could execute unauthenticated free-tier provider searches on reachable legacy workers when the shared secret was unset. Operators should upgrade; development workers must now configure both the environment and shared secret. Remote development peers must explicitly configure a protected bind.

Thanks to Syed Anas Mohiuddin (Cognivators LLC, GitHub: SyedAnas01) for reporting the issue.

Validation: 3,066 local tests passed, 49 skipped; wheel and sdist pass Twine checks; the isolated installed wheel rejects the reported PoC. All eight native CI checks and trusted review passed for the exact source in PR #217.

Assets 2
Loading