Skip to content

/_status/vars is world readable #50126

@korpa

Description

@korpa

Describe the problem

Spin up a secure cluster with cli parameters

  • --certs-dir=
  • --advertise-addr=
  • --join=
  • --cache=
  • --max-sql-memory=

To Reproduce

goto https://[ip]:8080/_status/vars

Expected behavior

  • Endpoint is only accessable via authentication like basic-auth
    or
  • A cli parameter e.g. --activate-status-vars=true is needed to activate it
    or
  • At least a warning on https://www.cockroachlabs.com/docs/stable/security-overview.html that this endpoint is exposed to the world and a http proxy to secure this endpoint is needed.

Additional data / screenshots

Environment:

  • CockroachDB version 20.1

Additional context

Metadata

Metadata

Assignees

Labels

A-docsA-securityA-webui-securityC-bugCode not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.O-communityOriginated from the community

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions