|
2 | 2 | "@context": "https://openvex.dev/ns/v0.2.0", |
3 | 3 | "@id": "https://openvex.dev/docs/permitio-pdp/pdp-v2-cve-waivers", |
4 | 4 | "author": "Permit.io", |
5 | | - "timestamp": "2026-07-07T00:00:00Z", |
6 | | - "version": 2, |
| 5 | + "timestamp": "2026-07-21T00:00:00Z", |
| 6 | + "version": 3, |
7 | 7 | "statements": [ |
8 | 8 | { |
9 | 9 | "vulnerability": { |
10 | | - "name": "CVE-2026-50163" |
| 10 | + "name": "CVE-2026-48818" |
11 | 11 | }, |
12 | 12 | "products": [ |
13 | 13 | { |
14 | 14 | "@id": "pkg:docker/permitio/pdp-v2@next", |
15 | 15 | "subcomponents": [ |
16 | | - { "@id": "pkg:golang/oras.land/oras-go/v2@2.6.1" } |
| 16 | + { "@id": "pkg:pypi/starlette@0.50.0" } |
17 | 17 | ] |
18 | 18 | } |
19 | 19 | ], |
20 | 20 | "status": "not_affected", |
21 | 21 | "justification": "vulnerable_code_not_in_execute_path", |
22 | | - "impact_statement": "The PDP runs OPA in inline mode via OPAL over OPA's REST API and never pulls OCI artifacts, so oras-go's tar/hardlink extraction (the vulnerable code path in CVE-2026-50163) is never executed. oras-go is an indirect dependency of the bundled OPA (built from permitio/permit-opa); no fixed release exists yet (all versions <= 2.6.1 are affected, upstream fix expected ~2026-07-15). This waiver is temporary and must be removed once permit-opa bumps oras-go to the patched release. Tracked under PER-15358." |
| 22 | + "impact_statement": "CVE-2026-48818 is an SSRF / NTLM credential-theft issue in starlette.staticfiles that only triggers on Windows, via UNC-path resolution when serving a StaticFiles mount. The PDP runs exclusively on Linux (Alpine) and mounts no StaticFiles anywhere in the app (only API routers are mounted), so the vulnerable code path is never present or executed. The fix lands only in starlette >= 1.1.0, but opal-common/opal-client 0.9.6 cap starlette<1, so the PDP is pinned to 0.50.0 (see requirements.txt). This waiver is temporary and must be removed once OPAL relaxes its starlette<1 bound and starlette is upgraded to >= 1.3.1. Tracked under PER-15358." |
23 | 23 | }, |
24 | 24 | { |
25 | 25 | "vulnerability": { |
26 | | - "name": "CVE-2026-48818" |
| 26 | + "name": "CVE-2026-54283" |
27 | 27 | }, |
28 | 28 | "products": [ |
29 | 29 | { |
|
35 | 35 | ], |
36 | 36 | "status": "not_affected", |
37 | 37 | "justification": "vulnerable_code_not_in_execute_path", |
38 | | - "impact_statement": "CVE-2026-48818 is an SSRF / NTLM credential-theft issue in starlette.staticfiles that only triggers on Windows, via UNC-path resolution when serving a StaticFiles mount. The PDP runs exclusively on Linux (Alpine) and mounts no StaticFiles anywhere in the app (only API routers are mounted), so the vulnerable code path is never present or executed. The fix lands only in starlette >= 1.1.0, but opal-common/opal-client 0.9.6 cap starlette<1, so the PDP is pinned to 0.50.0 (see requirements.txt). This waiver is temporary and must be removed once OPAL relaxes its starlette<1 bound and starlette is upgraded to >= 1.3.1. Tracked under PER-15358." |
| 38 | + "impact_statement": "CVE-2026-54283 causes request.form() size limits to be silently ignored for application/x-www-form-urlencoded bodies, enabling a memory-exhaustion DoS. The PDP is a JSON-only API: it never calls request.form(), does not depend on python-multipart, and parses no form-encoded or multipart request bodies, so the vulnerable form-parsing path is never executed. The fix lands only in starlette >= 1.3.1, but opal-common/opal-client 0.9.6 cap starlette<1, so the PDP is pinned to 0.50.0 (see requirements.txt). This waiver is temporary and must be removed once OPAL relaxes its starlette<1 bound and starlette is upgraded to >= 1.3.1. Tracked under PER-15358." |
39 | 39 | }, |
40 | 40 | { |
41 | 41 | "vulnerability": { |
42 | | - "name": "CVE-2026-54283" |
| 42 | + "name": "CVE-2026-48710" |
43 | 43 | }, |
44 | 44 | "products": [ |
45 | 45 | { |
|
51 | 51 | ], |
52 | 52 | "status": "not_affected", |
53 | 53 | "justification": "vulnerable_code_not_in_execute_path", |
54 | | - "impact_statement": "CVE-2026-54283 causes request.form() size limits to be silently ignored for application/x-www-form-urlencoded bodies, enabling a memory-exhaustion DoS. The PDP is a JSON-only API: it never calls request.form(), does not depend on python-multipart, and parses no form-encoded or multipart request bodies, so the vulnerable form-parsing path is never executed. The fix lands only in starlette >= 1.3.1, but opal-common/opal-client 0.9.6 cap starlette<1, so the PDP is pinned to 0.50.0 (see requirements.txt). This waiver is temporary and must be removed once OPAL relaxes its starlette<1 bound and starlette is upgraded to >= 1.3.1. Tracked under PER-15358." |
| 54 | + "impact_statement": "CVE-2026-48710 lets a malformed HTTP Host header make request.url.path diverge from the path actually routed, so security checks that read request.url can be bypassed. The PDP performs no security decision on request.url: authentication is enforced per-route through FastAPI Depends security dependencies (HTTPBearer in horizon/authentication.py), not by path matching, and the app registers no add_middleware/BaseHTTPMiddleware and reads no raw ASGI scope paths. The one path-keyed authorization check - the write-route test in horizon/proxy/api.py cloud_proxy - reads request.path_params, which Starlette's router populates from the raw scope path and which this CVE explicitly leaves unaffected. The fix lands only in starlette >= 1.0.1, but opal-common/opal-client 0.9.6 cap starlette<1, so the PDP is pinned to 0.50.0 (see requirements.txt). This waiver is temporary and must be removed once OPAL relaxes its starlette<1 bound and starlette is upgraded to >= 1.3.1. Tracked under PER-15358." |
| 55 | + }, |
| 56 | + { |
| 57 | + "vulnerability": { |
| 58 | + "name": "CVE-2026-48817" |
| 59 | + }, |
| 60 | + "products": [ |
| 61 | + { |
| 62 | + "@id": "pkg:docker/permitio/pdp-v2@next", |
| 63 | + "subcomponents": [ |
| 64 | + { "@id": "pkg:pypi/starlette@0.50.0" } |
| 65 | + ] |
| 66 | + } |
| 67 | + ], |
| 68 | + "status": "not_affected", |
| 69 | + "justification": "vulnerable_code_not_in_execute_path", |
| 70 | + "impact_statement": "CVE-2026-48817 is an unsafe-reflection issue in starlette.endpoints.HTTPEndpoint request dispatch: the HTTP method is lowercased and resolved with getattr against the endpoint instance without restricting the lookup to known HTTP verbs, letting an attacker invoke internal helper methods that bypass authorization. The PDP defines no HTTPEndpoint or WebSocketEndpoint subclass anywhere in the codebase - every route is registered through FastAPI APIRouter decorators with explicit HTTP methods - so the vulnerable dispatch class is never instantiated or reached. The fix lands only in starlette >= 1.1.0, but opal-common/opal-client 0.9.6 cap starlette<1, so the PDP is pinned to 0.50.0 (see requirements.txt). This waiver is temporary and must be removed once OPAL relaxes its starlette<1 bound and starlette is upgraded to >= 1.3.1. Tracked under PER-15358." |
55 | 71 | } |
56 | 72 | ] |
57 | 73 | } |
0 commit comments