From 08490972a53e4e838a594a4ccbe8fbac8c4815e3 Mon Sep 17 00:00:00 2001 From: Nick Craig-Wood Date: Tue, 14 Apr 2026 17:01:18 +0100 Subject: [PATCH] rc: snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176 Snapshot the NoAuth setting when the RC server is created rather than reading it from the mutable options struct on each request. This prevents any runtime mutation of rc.NoAuth (e.g. via options/set) from disabling the auth gate for protected RC methods. See GHSA-25qr-6mpr-f7qx --- fs/rc/rcserver/rcserver.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/rc/rcserver/rcserver.go b/fs/rc/rcserver/rcserver.go index 745a66c07..9c00afe95 100644 --- a/fs/rc/rcserver/rcserver.go +++ b/fs/rc/rcserver/rcserver.go @@ -53,6 +53,7 @@ type Server struct { files http.Handler pluginsHandler http.Handler opt *rc.Options + noAuth bool // snapshot of opt.NoAuth at startup to prevent runtime mutation } func newServer(ctx context.Context, opt *rc.Options, mux *http.ServeMux) (*Server, error) { @@ -104,6 +105,7 @@ func newServer(ctx context.Context, opt *rc.Options, mux *http.ServeMux) (*Serve opt: opt, files: fileHandler, pluginsHandler: pluginsHandler, + noAuth: opt.NoAuth, } var err error @@ -263,7 +265,7 @@ func (s *Server) handlePost(w http.ResponseWriter, r *http.Request, path string) } // Check to see if it requires authorisation - if !s.opt.NoAuth && call.AuthRequired && !s.server.UsingAuth() { + if !s.noAuth && call.AuthRequired && !s.server.UsingAuth() { writeError(path, in, w, fmt.Errorf("authentication must be set up on the rc server to use %q or the --rc-no-auth flag must be in use", path), http.StatusForbidden) return }