{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.2.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "clauster"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-10T20:37:23Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nA Clauster instance bound to a **non-loopback** address (e.g. `0.0.0.0` or a LAN IP) can serve the entire dashboard and its API **without any authentication** \u2014 even when the operator has configured a password \u2014 if `auth.enabled` is left at its default (`false`). The operator believes the instance is password-protected; in reality every request is served unauthenticated.\n\n### Impact\nAn unauthenticated attacker with network access to the instance gains full control of the dashboard: list projects, **spawn/stop `claude remote-control` bridges in any project directory**, edit `CLAUDE.md`, read bridge logs, and (where configured) clone repositories. Because bridges run Claude Code against the host\u0027s project directories, this is effectively remote code execution in those projects.\n\nLoopback (`127.0.0.1`) deployments need no auth by design and are **not** affected.\n\n### Affected configurations\nAll released versions (\u2264 0.2.1) where **all** of the following hold:\n- `host` is a non-loopback address, **and**\n- `auth.password_required: true` and/or `auth.reverse_proxy.enabled: true` is set, **and**\n- `auth.enabled` is left at its default `false`.\n\nDocker deployments are affected: the image binds `0.0.0.0`, and the previously-documented `docker run` command did not set `auth.enabled`.\n\n### Root cause\nTwo layers checked different flags:\n- The runtime auth guard enforces authentication only when `config.auth.enabled` is true; when false it passes **every** request through unauthenticated.\n- The config validator, for a non-loopback bind, required only one of `auth.password_required` / `auth.reverse_proxy.enabled` / `auth.allow_unauthenticated_network` \u2014 **not** `auth.enabled`. So a config with a password but `enabled=false` validated, started, and enforced nothing.\n\n### Proof of concept\nWith `host: 0.0.0.0`, `auth.password_required: true`, a valid `auth.password_hash`, and `auth.enabled` unset:\n\n```\ncurl http://\u003chost\u003e:7621/api/instances\n```\n\nreturns `200` with the full instance list and **no credentials**. Setting `auth.enabled: true` returns `401`.\n\n### Patches\nAn upcoming patch release makes the config validator **fail closed**: a non-loopback bind is refused unless authentication is actually enforced \u2014 `auth.enabled: true` together with `auth.password_required` (+ a hash) or `auth.reverse_proxy.enabled`, or the explicit `auth.allow_unauthenticated_network` opt-out. The README, `clauster.yml.example`, and Docker docs were corrected to match.\n\n### Workaround\nOn any non-loopback deployment, set `auth.enabled: true` in `clauster.yml` (or `CLAUSTER_AUTH_ENABLED=true`) alongside your existing `auth.password_required` + hash (or reverse-proxy) settings. Alternatively, bind to loopback only and reach it via an SSH tunnel or a trusted authenticating reverse proxy.\n\n### Credit\nFound during an internal security review.",
  "id": "GHSA-h4g2-xfmw-q2c9",
  "modified": "2026-07-10T20:37:23Z",
  "published": "2026-07-10T20:37:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/schubydoo/clauster/security/advisories/GHSA-h4g2-xfmw-q2c9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/schubydoo/clauster"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset"
}