{"id":"GHSA-h4g2-xfmw-q2c9","aliases":[],"url":"https://o3.security/vulnerability/GHSA-h4g2-xfmw-q2c9","summary":"Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset","details":"### Summary\nA Clauster instance bound to a **non-loopback** address (e.g. `0.0.0.0` or a LAN IP) can serve the entire dashboard and its API **without any authentication** — even when the operator has configured a password — if `auth.enabled` is left at its default (`false`). The operator believes the instance is password-protected; in reality every request is served unauthenticated.\n\n### Impact\nAn unauthenticated attacker with network access to the instance gains full control of the dashboard: list projects, **spawn/stop `claude remote-control` bridges in any project directory**, edit `CLAUDE.md`, read bridge logs, and (where configured) clone repositories. Because bridges run Claude Code against the host's project directories, this is effectively remote code execution in those projects.\n\nLoopback (`127.0.0.1`) deployments need no auth by design and are **not** affected.\n\n### Affected configurations\nAll released versions (≤ 0.2.1) where **all** of the following hold:\n- `host` is a non-loopback address, **and**\n- `auth.password_required: true` and/or `auth.reverse_proxy.enabled: true` is set, **and**\n- `auth.enabled` is left at its default `false`.\n\nDocker deployments are affected: the image binds `0.0.0.0`, and the previously-documented `docker run` command did not set `auth.enabled`.\n\n### Root cause\nTwo layers checked different flags:\n- The runtime auth guard enforces authentication only when `config.auth.enabled` is true; when false it passes **every** request through unauthenticated.\n- The config validator, for a non-loopback bind, required only one of `auth.password_required` / `auth.reverse_proxy.enabled` / `auth.allow_unauthenticated_network` — **not** `auth.enabled`. So a config with a password but `enabled=false` validated, started, and enforced nothing.\n\n### Proof of concept\nWith `host: 0.0.0.0`, `auth.password_required: true`, a valid `auth.password_hash`, and `auth.enabled` unset:\n\n```\ncurl http://<host>:7621/api/instances\n```\n\nreturns `200` with the full instance list and **no credentials**. Setting `auth.enabled: true` returns `401`.\n\n### Patches\nAn upcoming patch release makes the config validator **fail closed**: a non-loopback bind is refused unless authentication is actually enforced — `auth.enabled: true` together with `auth.password_required` (+ a hash) or `auth.reverse_proxy.enabled`, or the explicit `auth.allow_unauthenticated_network` opt-out. The README, `clauster.yml.example`, and Docker docs were corrected to match.\n\n### Workaround\nOn any non-loopback deployment, set `auth.enabled: true` in `clauster.yml` (or `CLAUSTER_AUTH_ENABLED=true`) alongside your existing `auth.password_required` + hash (or reverse-proxy) settings. Alternatively, bind to loopback only and reach it via an SSH tunnel or a trusted authenticating reverse proxy.\n\n### Credit\nFound during an internal security review.","published":"2026-07-10T20:37:23Z","modified":"2026-07-10T20:45:08.429787284Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"clauster","fixedVersion":"0.2.2"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/schubydoo/clauster/security/advisories/GHSA-h4g2-xfmw-q2c9"},{"type":"PACKAGE","url":"https://github.com/schubydoo/clauster"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-10T20:45:08.429787284Z"}}