Weakness (CWE)
CWE-441: Unintended Proxy or Intermediary
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere.
How to prevent it (2 mitigations)
-
Architecture and Design
Enforce the use of strong mutual authentication mechanism between the two parties.
-
Architecture and Design
Whenever a product is an intermediary or proxy for
transactions between two other components, the proxy core
should not drop the identity of the initiator of the
transaction. The immutability of the identity of the
initiator must be maintained and should be forwarded all the
way to the target.
Source: MITRE CWE-441
6 results · Clear filters · Feed
-
Low 3.5
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery…
-
Low 2.7
Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions wi…
-
Low 3.1
Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the …
-
Low 3.3
In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a con…
-
Low 2.2
GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a regis…
-
Low 3.1
Holes in EndpointSlice Validation Enable Host Network Hijack
A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.