GHSA-4wr3-f4p3-5wjh

Summary

The gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no auth_token is configured (the default). By adding dangerous tool names (e.g., shell_exec, file_write) to the allowlist, an attacker can cause the ExecApprovalManager to auto-approve all future agent invocations of those tools, bypassing the human-in-the-loop safety mechanism that the approval system is specifically designed to enforce.

Details

The vulnerability arises from the interaction of three components:

1. Authentication bypass in default config

_check_auth() in server.py:243-246 returns None (no error) when self.config.auth_token is falsy:

# server.py:243-246
def _check_auth(request) -> Optional[JSONResponse]:
    if not self.config.auth_token:
        return None  # No auth configured → allow everything

GatewayConfig defaults auth_token to None (config.py:61):

# config.py:61
auth_token: Optional[str] = None

2. Unrestricted allowlist modification

The approval_allowlist handler at server.py:381-420 calls _check_auth() and proceeds when it returns None:

# server.py:388-410
auth_err = _check_auth(request)
if auth_err:
    return auth_err
# ...
if request.method == "POST":
    _approval_mgr.allowlist.add(tool_name)  # No validation on tool_name
    return JSONResponse({"added": tool_name})

There is no validation that tool_name corresponds to a real tool, no restriction on which tools can be allowlisted, and no rate limiting.

3. Auto-approval fast path

When GatewayApprovalBackend.request_approval() is called by an agent (gateway_approval.py:87), it calls ExecApprovalManager.register(), which checks the allowlist first (exec_approval.py:141-144):

# exec_approval.py:140-144
# Fast path: already permanently allowed
if tool_name in self.allowlist:
    future.set_result(Resolution(approved=True,...