Offset

node-forge fails to properly enforce the `basicConstraints.pathLenConstraint` of an X.509 CA certificate unless the certificate also contains a `keyUsage` extension. An attacker possessing the private key of a path-length-constrained CA without `keyUsage`, or a subordinate CA certificate from it, could create a certificate chain that exceeds the declared path length but still passes the `pki.verifyCertificateChain()` function. This issue primarily affects private PKIs where CA certificates are created without the `keyUsage` extension.

A path traversal issue exists in the RST include directive. This allows attackers to read arbitrary files by providing relative or absolute paths. By submitting markdown containing include directives with `../` sequences or absolute paths, an attacker can embed sensitive files, such as credentials or environment data, into the rendered HTML.

An algorithmic complexity issue exists in the inline link parser. Unauthenticated attackers can cause CPU exhaustion by submitting markdown payloads containing long sequences of unmatched '[' characters. This triggers O(N^2) complexity during `parse link text()` and `parse link label()` probing, which can occupy rendering workers for over 30 seconds for every 16 KB of input.

The Include directive emits content from included .html, .xhtml, or .htm files as raw block html tokens. An attacker capable of placing an HTML file readable by the renderer can use an include directive combined with path traversal to execute stored scripts when the `escape` variable is set to False.

An issue exists where attackers controlling markdown input can inject arbitrary style declarations. This occurs through the unvalidated `figwidth` option of the figure directive. By appending declarations such as `background:url()`, attackers can force victim browsers to send requests to external servers, potentially leaking attribute values.

An issue exists where users can trigger server-side request forgery, a flaw that allows a server to be coerced into making requests to an unintended location. This occurs when the shared HTTP client requests arbitrary internal URLs through `extends` presets or `customDatasources`. This could allow an attacker to target an instance metadata service endpoint to retrieve AWS credentials or leak sensitive data via logs.

Soft Machine is a Virtual Machine–based agentic development environment and Cloud OS. The workspace HTTP service listening on 0.0.0.0:8080 within sm-ws-* Fly Machines exposes the endpoints '/health', '/file/<path>', and '/archive/<dir>' without authentication or origin checks. This allows any host capable of reaching TCP/8080 on a workspace to read arbitrary files under the `/workspace` root or download entire project trees as tar archives. Since workspaces share the same Fly private 6PN and resolve peer addresses via unauthenticated ` instances.internal` TXT records, any other sm-ws-* machine within the same Fly app or organization can act as an unauthenticated attacker, as the trust boundary between the workspace owner and other users is absent.

Two authentication helpers in the `/app/server.js` endpoint, specifically `verifyContainerAuth()` and `authenticateWorkspaceHttp()`, accept the global `CONTAINER SHARED SECRET` as a bearer token without verifying the workspace membership of the caller. Because this secret is identical across every container in the Fly app and is accessible from the user-facing process environment within each workspace, any tenant can use it to authenticate to the workspace API of any other tenant. This allows for cross-workspace read, write, and destructive-restore operations. While the `workspaceTokenMatches` function protects the standard per-workspace token path, the shared-secret bearer path bypasses this check entirely.

An insecure direct object reference occurs in the 'PUT /app/:appId' endpoint, which accepts attacker-controlled icon storage paths. Authenticated users can provide arbitrary paths within the private images bucket to obtain service-role-signed URLs valid for 7 days. This allows unauthorized reading of cross-tenant objects, such as user avatars, organization logos, and app icons.

An authorization flaw exists in the 'PATCH /private/role bindings/:binding id' endpoint. The handler verifies that the priority rank of a newly assigned role does not exceed the caller's rank, but it fails to check the rank of the role currently bound to the target binding. This allows an authenticated user with the `org admin` role (rank 90) to change an `org super admin` binding (rank 95) to a lower-privileged role, such as `org member` (rank 75). Since the `prevent last super admin binding delete` database trigger only executes before a delete operation and not during an update, an `org admin` can demote all `org super admin` users, potentially leaving the organization without a super administrator.

The OAuth fallback token directory and JSON files are created without restrictive owner-only permissions, typically resulting in world-readable files (mode `0644` on Linux) and directories (mode `0755`). This allows local users or processes on shared systems to read sensitive credentials, including `access token`, `refresh token`, `cloud id`, and `base url`, from the `~/.mcp-atlassian` directory and `oauth-<client id>.json` files. An attacker can use these tokens to impersonate the victim and gain unauthorized persistent access to Jira and Confluence data via the Atlassian API. The issue occurs within the ` save tokens to file()` function in `src/mcp atlassian/utils/oauth.py` when the software falls back to file storage because the system keyring is unavailable.

An unauthenticated caller can perform a Server-Side Request Forgery (SSRF) attack using a DNS-rebinding technique. The software employs a validate-then-use pattern where the `validate url for ssrf()` function resolves a hostname to ensure it is globally routable, but the actual HTTP connection occurs later with a separate DNS resolution. An attacker can provide a hostname that returns a public address during validation and an internal address during the actual connection, allowing requests to reach internal services or cloud metadata services (e.g., 169.254.169.254) to steal IAM credentials or scan internal networks. This issue is triggered via the following header-supplied parameters: - `X-Atlassian-Jira-Url` - `X-Atlassian-Confluence-Url`

The OAuth 2.0 setup wizard's local callback HTTP server reflects the `error` query parameter directly into an HTML response without sanitization or encoding. This occurs within the `CallbackHandler` class in `oauth setup.py`, where the `error` parameter is passed to the ` send response()` function and interpolated into an HTML page. A crafted authorization callback can inject markup or scripts that execute in the browser of a user completing the OAuth flow. The risk is increased because the server binds to all network interfaces (`0.0.0.0`), making it accessible from the local network, and lacks security headers such as `Content-Security-Policy` and `X-Content-Type-Options`.

The Jira and Confluence attachment upload tools fail to validate file paths, allowing for path traversal. An authenticated MCP client or an AI assistant manipulated via prompt injection can provide arbitrary values to the `file path` variable, which the server treats as trusted local paths. This allows the disclosure and exfiltration of any file readable by the server process, such as environment files, SSH keys, and application configurations, by uploading them to a Confluence page or Jira issue. The issue occurs within the `confluence upload attachment` and `jira upload attachment` functions, specifically where `open(file path, "rb")` is called without using the `validate safe path` utility.

An LDAP filter injection exists in ldap-authorization and ad-authorization modes. This occurs because usernames are inserted unescaped into LDAP search filters, and the authentication process only verifies the existence of the user. When `REMOTE USER` is not forwarded, unauthenticated attackers can use a wildcard username via HTTP Basic Authorization through the `PHP AUTH USER` variable to match all users and groups, allowing them to gain administrative access.

An unauthenticated denial of service issue exists in the '/api/v1/text-to-speech/abort' endpoint. The system accepts the `chatflowId` and `chatId` variables without verifying ownership, allowing attackers to terminate active chatflow predictions for any user by providing known identifiers, which results in targeted service disruption.

Authenticated non-admin users can execute arbitrary processes as the server's OS user, which is often root in Docker, npx, or systemd deployments. This occurs because the 'POST /api/servers' and 'PUT /api/servers/:name' endpoints lack authorization checks and do not sanitize the `command` and `args` fields before passing them to the `child process.spawn` function.

In the enterprise tier, two endpoints serving in-house iOS application packages and manifests lack the intended random, time-limited URL token protection. Since Apple's InstallEnterpriseApplication MDM command requires these URLs to be accessible without a Fleet session, session-based authentication is not used. This allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and metadata, including the bundle identifier, version, and name, by guessing sequential title identifiers. The impact is limited to read-only disclosure.

When the `builtin: ['*']` configuration is used, the software fails to restrict access to the `os` and `dns` built-in modules. This allows code running within the sandbox to access process-wide observability data and mutate the state of the host process. Specifically, an attacker can use `os.userInfo()` to read the host process owner's identity (UID, GID, username, and home directory) and `os.networkInterfaces()` to disclose the full host network topology, including IP and MAC addresses. Furthermore, the sandbox can perform unauthorized writes to the host process. Using the `os.setPriority()` function, an attacker can change the host process priority. Most critically, by invoking the `dns.setServers()` function, an attacker can globally hijack the host process DNS resolver. This redirects all subsequent DNS queries made by the host—including outbound HTTP requests, telemetry, and package registry lookups—through a resolver controlled by the attacker, potentially leading to credential theft or supply chain attacks.

An issue exists where the software fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint. This allows unauthenticated attackers to abuse private chatflow text-to-speech credentials by providing a valid `chatflow UUID`. Consequently, attackers can generate unlimited audio using stored OpenAI or ElevenLabs API keys, leading to financial costs for the chatflow owner.