Authorize docker/terminal WebSocket handlers
fix(security): authorize docker/terminal WebSocket handlers
Authorize docker/terminal WebSocket handlers68f5af-fix-authorize-docker-terminal-websocket-handlers-cve-2026-72863-cve-2026-72864fixauthorize docker terminal websocket handlers security
Committed by Siumauricio
commit message
fix(security): authorize docker/terminal WebSocket handlers
The /terminal, /docker-container-terminal, /docker-container-logs and
/docker-stats WebSocket handlers only checked session + organization, so any
authenticated member could open a root shell / read logs of any container, and
the local (serverId=local) branch reached a root SSH shell on the control-plane
host.
Adds an authorization layer (server/wss/authorize.ts):
- container ops (terminal/logs/stats): require the docker permission (owner/admin
or a member granted canAccessToDocker); for a remote server, require the server
be accessible to the caller.
- host/server terminal: the local host root terminal is restricted to owner/admin;
a remote server terminal is gated on server access.
Closes GHSA-c68r-7wg9-p7v2, GHSA-899j-cjwp-v4gw, GHSA-7r6p-v9gw-pwc8, GHSA-qf9j-c9p4-r4xpEditor assessment
This commit patches CVE-2026-72863 and CVE-2026-72864. The subject is blunt and accurate: authorize docker and terminal WebSocket handlers. The body opens with the impact, explaining that four endpoints checked only session and organization, so any authenticated member could open a root shell or read container logs, and that the local branch reached a root SSH shell on the control-plane host. It then describes the new authorization module, container operations requiring the docker permission or an explicit grant, and host terminals restricted to owner and admin. All four GHSAs are closed. Exemplary threat modeling.