Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Admin API has no authentication by default, and the flag that fixes it is undocumented

Aperta
  • Qualcosa non va?
#2,291 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

@carfeii ci sta già lavorando.

Dal 16/10/2026.

  • #2292 di @carfeii — aperta

Valutazione

Difficoltà
3/5
Tempo stimato
Mezza giornata
Idoneità per principianti
30/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
authentication, documentation, security

Direzione di ricerca

Start with auth_middleware in libsql-server/src/http/admin/mod.rs, which only checks the bearer token when --admin-auth-key is set, then read handle_post_config and handle_create_namespace where jwt_key, heartbeat_url and dump_url are applied. The docs side is docs/ADMIN_API.md and the Authentication section of docs/DOCKER.md. Done means the flag and its implications are documented, and a maintainer has decided whether the admin API should fail closed without a key; that decision is not in the payload.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

sqld's admin API (enabled with --admin-listen-addr and --enable-namespaces) manages every namespace on the instance: creating, deleting, and forking namespaces, and rewriting a namespace's own config, including its jwt_key (which controls who can authenticate to that namespace's user-facing Hrana/HTTP API) and heartbeat_url / the namespace-create dump_url field (both cause the server to make an outbound HTTP request to a URL supplied in the request body).

The admin API only enforces authentication when --admin-auth-key / LIBSQL_ADMIN_AUTH_KEY has actually been set. Without it, every admin route is open to anyone who can reach the listen address. Neither docs/ADMIN_API.md (the admin API's own documentation, which explains exactly how to turn the feature on) nor docs/DOCKER.md's "Authentication" section (which documents the two user-facing auth environment variables) mentions this flag at all, so an operator following either doc has no way to learn it exists.

Affected versions: confirmed on main, commit d8bc862d20bedc72945a1da27c8b7045414c0261, and on the published image ghcr.io/tursodatabase/libsql-server:latest (sqld 0.24.33, commit d6c75af6353bb1c34985399608e37cd272a35aa1).

Details

libsql-server/src/http/admin/mod.rs's auth_middleware only checks a bearer token if one was configured at startup:

if let Some(ref auth) = auth {
    // ...checks happen only inside this branch
}
Ok(next.run(request).await)

With no --admin-auth-key, this function is a no-op and every route (/v1/namespaces/:namespace/create, /v1/namespaces/:namespace (DELETE), /v1/namespaces/:namespace/fork/:to, /v1/namespaces/:namespace/config) runs unauthenticated. handle_post_config and handle_create_namespace both accept a jwt_key field and a heartbeat_url (create also accepts dump_url), and apply them with no additional check.

Steps To Reproduce

(available upon request)

Impact

Anyone who can reach the admin API's listen address, with zero credentials, can create, delete, and fork any namespace on the instance, and can rewrite a namespace's jwt_key, a full authentication bypass on every tenant namespace, since the attacker can then mint their own valid tokens for that namespace's user-facing API. The same unauthenticated requests can also set heartbeat_url or dump_url to an attacker-chosen address, causing the server to make outbound requests to arbitrary destinations, including cloud metadata endpoints. Multi-tenant namespace usage is the admin API's primary documented purpose, so this affects exactly the deployment shape the feature exists for.

I've opened a documentation PR adding this flag and its implications to both ADMIN_API.md and DOCKER.md.

Lingua principale
C
Stelle
17.3k
Fork
545
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di tursodatabase/libsql

Tutte le issue di tursodatabase/libsql

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.