Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Admin API has no authentication by default, and the flag that fixes it is undocumented

オープン
  • 何か問題がありますか？
#2,291 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

@carfeii がすでに取り組んでいます。

2026年10月16日 から。

  • #2292 @carfeii による — オープン

評価

難易度
3/5
見積もり時間
半日
初心者へのやさしさ
30/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
rust
領域
authentication, documentation, security

調査の方向性

Start with auth_middleware in libsql-server/src/http/admin/mod.rs, which only checks the bearer token when --admin-auth-key is set, then read handle_post_config and handle_create_namespace where jwt_key, heartbeat_url and dump_url are applied. The docs side is docs/ADMIN_API.md and the Authentication section of docs/DOCKER.md. Done means the flag and its implications are documented, and a maintainer has decided whether the admin API should fail closed without a key; that decision is not in the payload.

索引モデルが issue の本文から書いたものです。

説明

Summary

sqld's admin API (enabled with --admin-listen-addr and --enable-namespaces) manages every namespace on the instance: creating, deleting, and forking namespaces, and rewriting a namespace's own config, including its jwt_key (which controls who can authenticate to that namespace's user-facing Hrana/HTTP API) and heartbeat_url / the namespace-create dump_url field (both cause the server to make an outbound HTTP request to a URL supplied in the request body).

The admin API only enforces authentication when --admin-auth-key / LIBSQL_ADMIN_AUTH_KEY has actually been set. Without it, every admin route is open to anyone who can reach the listen address. Neither docs/ADMIN_API.md (the admin API's own documentation, which explains exactly how to turn the feature on) nor docs/DOCKER.md's "Authentication" section (which documents the two user-facing auth environment variables) mentions this flag at all, so an operator following either doc has no way to learn it exists.

Affected versions: confirmed on main, commit d8bc862d20bedc72945a1da27c8b7045414c0261, and on the published image ghcr.io/tursodatabase/libsql-server:latest (sqld 0.24.33, commit d6c75af6353bb1c34985399608e37cd272a35aa1).

Details

libsql-server/src/http/admin/mod.rs's auth_middleware only checks a bearer token if one was configured at startup:

if let Some(ref auth) = auth {
    // ...checks happen only inside this branch
}
Ok(next.run(request).await)

With no --admin-auth-key, this function is a no-op and every route (/v1/namespaces/:namespace/create, /v1/namespaces/:namespace (DELETE), /v1/namespaces/:namespace/fork/:to, /v1/namespaces/:namespace/config) runs unauthenticated. handle_post_config and handle_create_namespace both accept a jwt_key field and a heartbeat_url (create also accepts dump_url), and apply them with no additional check.

Steps To Reproduce

(available upon request)

Impact

Anyone who can reach the admin API's listen address, with zero credentials, can create, delete, and fork any namespace on the instance, and can rewrite a namespace's jwt_key, a full authentication bypass on every tenant namespace, since the attacker can then mint their own valid tokens for that namespace's user-facing API. The same unauthenticated requests can also set heartbeat_url or dump_url to an attacker-chosen address, causing the server to make outbound requests to arbitrary destinations, including cloud metadata endpoints. Multi-tenant namespace usage is the admin API's primary documented purpose, so this affects exactly the deployment shape the feature exists for.

I've opened a documentation PR adding this flag and its implications to both ADMIN_API.md and DOCKER.md.

主要言語
C
スター
17.3k
フォーク
545
30日以内にマージされた PR はありません

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

tursodatabase/libsql のほかの issue

tursodatabase/libsql の issue をすべて見る

似ている issue

C の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。