-
Notifications
You must be signed in to change notification settings - Fork 4.1k
/_status/vars is world readable #50126
Copy link
Copy link
Closed
Labels
A-docsA-securityA-webui-securityC-bugCode not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.O-communityOriginated from the communityOriginated from the community
Description
Describe the problem
Spin up a secure cluster with cli parameters
- --certs-dir=
- --advertise-addr=
- --join=
- --cache=
- --max-sql-memory=
To Reproduce
goto https://[ip]:8080/_status/vars
Expected behavior
- Endpoint is only accessable via authentication like basic-auth
or - A cli parameter e.g. --activate-status-vars=true is needed to activate it
or - At least a warning on https://www.cockroachlabs.com/docs/stable/security-overview.html that this endpoint is exposed to the world and a http proxy to secure this endpoint is needed.
Additional data / screenshots
Environment:
- CockroachDB version 20.1
Additional context
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
A-docsA-securityA-webui-securityC-bugCode not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.Code not up to spec/doc, specs & docs deemed correct. Solution expected to change code/behavior.O-communityOriginated from the communityOriginated from the community