{"uuid": "105792f8-b0cd-4152-8519-e5ec5bbccec3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-h4g2-xfmw-q2c9", "type": "seen", "source": "https://gist.github.com/alon710/5e2741edb2d79f8c7e4e9d0fb2942745", "content": "# GHSA-H4G2-XFMW-Q2C9: GHSA-H4G2-XFMW-Q2C9: Missing Authentication Bypass in Clauster Configuration Validator\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/GHSA-H4G2-XFMW-Q2C9\n\n## Summary\nClauster versions up to and including v0.2.1 suffer from an authentication bypass vulnerability. This issue occurs when Clauster is configured with an authentication method but the master auth.enabled key is omitted or set to false, allowing unauthenticated network access to administrative endpoints and arbitrary code execution through managed Claude Code bridges.\n\n## TL;DR\nClauster v0.2.1 and below allows a silent authentication bypass on non-loopback network bindings if the 'auth.enabled' configuration key is omitted, leading to remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306\n- **Attack Vector**: Adjacent Network\n- **CVSS v4 Score**: 8.7\n- **Exploit Status**: PoC Available\n- **Impact**: Remote Code Execution (RCE)\n- **Affected Component**: Configuration Validator & Auth Guard\n\n## Affected Systems\n\n- Clauster\n- **Clauster**: <= 0.2.1 (Fixed in: `v0.2.2`)\n\n## Mitigation\n\n- Upgrade the clauster package to version v0.2.2 or higher.\n- Explicitly set auth.enabled to true in the configuration configuration file.\n- Restrict network bindings to the loopback interface (127.0.0.1).\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade clauster' or 'uv pip install --upgrade clauster' to update to v0.2.2.\n2. Inspect your configuration file (clauster.yml) and set auth.enabled: true.\n3. Regenerate secure password hashes using the 'clauster hash-password' utility.\n4. Restart the Clauster application daemon or container.\n\n## References\n\n- [GHSA-H4G2-XFMW-Q2C9 on GitHub Advisory Database](https://github.com/advisories/GHSA-H4G2-XFMW-Q2C9)\n- [Clauster Repository Security Advisory](https://github.com/schubydoo/clauster/security/advisories/GHSA-h4g2-xfmw-q2c9)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-H4G2-XFMW-Q2C9) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-10T23:12:24.736613Z"}