Raphael Zanarelli

An authorization flaw allows authenticated users to retrieve information about data sources they are not permitted to access. The issue occurs because the '/unauth-datasource' and '/authed-datasource' endpoints do not properly enforce access controls, leading to the disclosure of sensitive connection details and passwords. This could enable unauthorized access to the underlying databases.

The '/datasources/unauth-datasource' endpoint fails to properly enforce authorization for data sources. An authenticated user can call this endpoint to retrieve information about data sources they are not permitted to access, potentially exposing sensitive metadata and data source configurations.

The Task SDK fails to mask the contents of a Variable when its JSON value is a list. This occurs because masking is only applied to deserialized values that are strings or dictionaries, leaving top-level lists unmasked. Consequently, secrets stored in this format are displayed in cleartext within task logs and the Rendered Templates UI. An authenticated user with permissions to view task logs or rendered templates can recover these values without any special configuration.