Description

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/{id} endpoints. The GitHubTokenHTTPAuth middleware only validates that a caller presents a valid GitHub OAuth token without verifying ownership or access rights to the target project, enabling attackers with any valid GitHub token to invoke bare KV-store operations such as projects.Fetch and project.Delete against any project ID to achieve cross-tenant project takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-11T19:18:42.393Z",
  "pubdate": "2026-08-11T19:18:42.393Z",
  "executiveSummary": "Taubyte Tau v1.1.10 suffers from a critical missing authorization vulnerability located within the services/auth HTTP service. The flaw allows any authenticated user to read or permanently delete arbitrary projects belonging to other tenants by supplying an arbitrary project identifier to the GET and DELETE /projects/{id} endpoints. This security deficiency stems from improper access control enforcement within the GitHubTokenHTTPAuth middleware, which strictly validates the presence of a valid GitHub OAuth token without subsequently verifying whether the caller possesses legitimate ownership or explicit access rights to the targeted project resource. Consequently, threat actors possessing any valid GitHub token are empowered to execute bare key-value store operations, specifically projects.Fetch and project.Delete, against arbitrary project IDs. The risk implications include complete cross-tenant project takeover, unauthorized data exposure, and destructive data loss. Exploitation of this vulnerability requires network connectivity to the authentication service and possession of a standard, valid GitHub token, bypassing all intended tenant isolation boundaries.",
  "technicalDetails": "The vulnerability resides in the services/auth HTTP service of Taubyte Tau v1.1.10, specifically affecting how incoming requests are processed and authorized by the middleware layer. The root cause of the security issue is the implementation of the GitHubTokenHTTPAuth middleware. During the request validation phase, this middleware inspects the provided credentials and confirms only that the caller presents a syntactically and cryptographically valid GitHub OAuth token. However, it fails to perform subsequent authorization checks to map the authenticated identity to the requested resource or verify tenant boundaries.\nThe affected components comprise the HTTP endpoints GET /projects/{id} and DELETE /projects/{id}. When a request hits these endpoints, the underlying logic invokes bare key-value store operations, namely projects.Fetch and project.Delete, utilizing the user-supplied project ID directly without validating resource ownership or access control lists.\nThe attack flow proceeds as follows: First, an attacker obtains any valid GitHub OAuth token, which can be acquired through standard, legitimate authentication mechanisms against GitHub. Second, the attacker crafts an HTTP request targeting the vulnerable endpoints of the Taubyte Tau services/auth service, specifying the targeted victim tenant's project ID within the Uniform Resource Identifier path, such as GET /projects/{target_project_id} or DELETE /projects/{target_project_id}. Third, the attacker includes the valid GitHub OAuth token within the request headers. Fourth, the GitHubTokenHTTPAuth middleware intercepts the request, validates the token successfully, and passes the request downstream without checking authorization. Fifth, the application executes the projects.Fetch or project.Delete operation against the arbitrary project ID in the key-value store.\nThis behavior enables attackers to achieve complete cross-tenant project takeover, leading to the unauthorized extraction of sensitive project data or the irreversible permanent deletion of victim projects. The privilege requirement is minimal, as any authenticated user with a valid GitHub token can successfully exploit the flaw. The network exposure is tied directly to the services/auth HTTP service accessibility."
}