Security Digest · Critical advisory (no CVE assigned)
GHSA-9h64-2846-7x7f: Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening
Summary Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-tenant isolation, access-control, and policy-enforcement defects in the AxonFlow platform.
CVSS 9.1 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
govulncheck ./.... - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Go | github.com/getaxonflow/axonflow | < 7.5.0 | 7.5.0 |
Details
Summary
Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-tenant isolation, access-control, and policy-enforcement defects in the AxonFlow platform. They are filed as a single consolidated advisory because the recommended remediation is a single platform upgrade.
Affected versions
Patched versions
>= 7.5.0.
Impact
| # | Item | Affected | Patched | CWE | |---|---|---|---|---| | 1 | MAP execution multi-tenant isolation. A body-supplied orgid could override the Basic-auth-derived org for both execution recording and policy evaluation. In multi-tenant deployments with shared agents, this could record one tenant's request under another tenant's audit log and evaluate it under the wrong tenant's policy set. | = 7.4.5 | CWE-863 | | 2 | Cross-tenant audit-log leak via evidence/explain handlers. The handlers behind /api/v1/evidence/ and /api/v1/decisions//explain failed open when the tenant context was missing, returning data scoped to a different tenant or returning data without scope. | = 7.2.0 | CWE-200, CWE-863 | | 3 | License-validation bypass on onboard-customer. The portal customer-onboard endpoint lacked authentication and license-key validation, allowing unauthenticated callers to invoke the onboard flow. | = 7.2.0 | CWE-862 | | 4 | Tenant-scope fail-open on evidence/explain. Distinct from item 2: when tenant headers were absent, the handler defaulted to a permissive read scope rather than refusing the request. | = 7.2.0 | CWE-862 | | 5 | Internal-service auth fallback bypass in non-Community modes. Evaluation/Enterprise builds carried an auth fallback path that, under specific request shapes, could be exploited to bypass apiAuthMiddleware. | = 7.2.0 | CWE-863 | | 6 | Login timing / org-existence disclosure on the portal. The login handler returned different timing and response bodies for invalid-org vs invalid-password, allowing org enumeration. | = 7.1.3 | CWE-208 | | 7 | Portal DoS via unbounded request body. The portal accepted unbounded request bodies, allowing memory-exhaustion attacks. Capped at 1 MiB. | = 7.1.5 | CWE-770 | | 8 | SQL-injection…
CVSS: 9.1 (v3.1) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Sources and references
- GitHub Advisory GHSA-9h64-2846-7x7f github.com
- github.com github.com
- github.com github.com
- github.com github.com