sean/kratos-identity-operator
Watch
1
0
Fork
You've already forked kratos-identity-operator
 0
Code Issues Pull requests Projects Releases 22 Packages Wiki Activity
22 releases 33 tags
  • v0.5.18 6a76a73085

    v0.5.18 Stable

    pipeline-bot released this 2026-07-27 23:37:13 +00:00 | 15 commits to trunk since this release

    Security

    • Refuse redirects on Kratos Admin API calls. 0.5.16 pinned
      kratosAdminURL to the in-namespace kratos-admin Service to stop a CR
      author from redirecting the controller's Secret-backed password submission to
      an arbitrary endpoint, but the pin only constrained the URL the operator
      dials. The shared client set no CheckRedirect, so Go followed up to ten
      redirects across origins and replayed the request body on 307/308 — and the
      create/update bodies carry the plaintext password. Anyone able to create a
      Service named kratos-admin on port 4434 in their own namespace satisfied
      the pin and could then forward the credential anywhere, which is exactly the
      confused-deputy the pin was added to prevent. The client now returns the 3xx
      to the caller, where it fails the status-code check like any other unexpected
      response; the Kratos Admin API never answers a legitimate request with a
      redirect. Both halves now come from one controller.NewAdminHTTPClient
      constructor so the shipped client and the tested client cannot drift.

    Included changes (v0.5.17 -> v0.5.18)

    • 569b504a5d12 fix(security): refuse redirects on Kratos Admin API calls
    Downloads