Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Admin API has no authentication by default, and the flag that fixes it is undocumented

Abierto
  • ¿Algo no está bien?
#2,291 0 comentarios 0 reacciones 0 asignados Ver en GitHub

@carfeii ya está trabajando en esto.

Desde el 16/10/2026.

  • #2292 de @carfeii — abierto

Evaluación

Dificultad
3/5
Tiempo estimado
Medio día
Aptitud para principiantes
30/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
rust
Área
authentication, documentation, security

Línea de trabajo

Start with auth_middleware in libsql-server/src/http/admin/mod.rs, which only checks the bearer token when --admin-auth-key is set, then read handle_post_config and handle_create_namespace where jwt_key, heartbeat_url and dump_url are applied. The docs side is docs/ADMIN_API.md and the Authentication section of docs/DOCKER.md. Done means the flag and its implications are documented, and a maintainer has decided whether the admin API should fail closed without a key; that decision is not in the payload.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

sqld's admin API (enabled with --admin-listen-addr and --enable-namespaces) manages every namespace on the instance: creating, deleting, and forking namespaces, and rewriting a namespace's own config, including its jwt_key (which controls who can authenticate to that namespace's user-facing Hrana/HTTP API) and heartbeat_url / the namespace-create dump_url field (both cause the server to make an outbound HTTP request to a URL supplied in the request body).

The admin API only enforces authentication when --admin-auth-key / LIBSQL_ADMIN_AUTH_KEY has actually been set. Without it, every admin route is open to anyone who can reach the listen address. Neither docs/ADMIN_API.md (the admin API's own documentation, which explains exactly how to turn the feature on) nor docs/DOCKER.md's "Authentication" section (which documents the two user-facing auth environment variables) mentions this flag at all, so an operator following either doc has no way to learn it exists.

Affected versions: confirmed on main, commit d8bc862d20bedc72945a1da27c8b7045414c0261, and on the published image ghcr.io/tursodatabase/libsql-server:latest (sqld 0.24.33, commit d6c75af6353bb1c34985399608e37cd272a35aa1).

Details

libsql-server/src/http/admin/mod.rs's auth_middleware only checks a bearer token if one was configured at startup:

if let Some(ref auth) = auth {
    // ...checks happen only inside this branch
}
Ok(next.run(request).await)

With no --admin-auth-key, this function is a no-op and every route (/v1/namespaces/:namespace/create, /v1/namespaces/:namespace (DELETE), /v1/namespaces/:namespace/fork/:to, /v1/namespaces/:namespace/config) runs unauthenticated. handle_post_config and handle_create_namespace both accept a jwt_key field and a heartbeat_url (create also accepts dump_url), and apply them with no additional check.

Steps To Reproduce

(available upon request)

Impact

Anyone who can reach the admin API's listen address, with zero credentials, can create, delete, and fork any namespace on the instance, and can rewrite a namespace's jwt_key, a full authentication bypass on every tenant namespace, since the attacker can then mint their own valid tokens for that namespace's user-facing API. The same unauthenticated requests can also set heartbeat_url or dump_url to an attacker-chosen address, causing the server to make outbound requests to arbitrary destinations, including cloud metadata endpoints. Multi-tenant namespace usage is the admin API's primary documented purpose, so this affects exactly the deployment shape the feature exists for.

I've opened a documentation PR adding this flag and its implications to both ADMIN_API.md and DOCKER.md.

Lenguaje dominante
C
Estrellas
17.3k
Forks
545
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de tursodatabase/libsql

Todos los issues de tursodatabase/libsql

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.