Thaidn

An issue exists where the system fails to verify if the caller-selected namespace or database matches the authentication level of a namespace- or database-level system user, enabling cross-tenant access. An authenticated attacker can manipulate the `Surreal-NS` and `Surreal-DB` headers on the '/sql' endpoint or utilize the `use()` RPC method to perform unauthorized operations, including reading, creating, modifying, and deleting rows, as well as reading `DEFINE PARAM` values in another tenant, provided that table PERMISSIONS allow such actions.

Authenticated attackers can execute arbitrary SQL queries and retrieve results in HTTP responses. This occurs because the trace-funnel analytics endpoints interpolate the `service name` and `span name` fields into ClickHouse string literals without proper escaping.

The HTTP handler fails to apply authorization wrappers to trace-funnel analytics endpoints. This allows unauthenticated attackers to submit arbitrary funnel definitions to retrieve trace analytics, including identifiers, durations, span counts, service topology, and error activity, without providing credentials.

The Kubernetes ingress-nginx provider mishandles Ingresses that contain both an authentication annotation and the `nginx.ingress.kubernetes.io/from-to-www-redirect` annotation. This causes the provider to create a sibling router that matches only on the host and utilizes the RedirectRegex middleware while pointing to the protected backend service. Since RedirectRegex is not a terminal handler, requests that do not match its pattern are forwarded to the backend. By using a crafted Host header with a non-numeric or empty port (e.g., 'Host: www.example.com:x'), an attacker can select this sibling router and bypass the redirect. This results in the request being proxied to the protected backend without any annotation-derived middlewares being applied, effectively bypassing authentication (such as BasicAuth) and source-IP allowlisting.

A weak robustness vulnerability exists in the AWS Encryption SDKs due to the non-committing property of AES-GCM and other AEAD ciphers. This allows an attacker to craft a unique ciphertext that decrypts to multiple different results, particularly in a multi-recipient setting. The vulnerability also enables information leakage and ciphertext forgery attacks. An attacker can create ciphertexts that leak the user's AWS account ID, encryption context, user agent, and IP address upon decryption. Additionally, an attacker can create ciphertexts that are accepted by other users. The non-committing property of AES-GCM can cause nonidentical plaintexts when decrypting a single ciphertext with two different keys.