Description

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the `/federated` endpoint with the `Upgrade: websocket` header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-11T20:18:45.260Z",
  "pubdate": "2026-08-11T20:18:45.260Z",
  "executiveSummary": "An authentication bypass vulnerability has been identified within the search-v2-api component. The core security flaw stems from an improper implementation in the authentication middleware, which unconditionally evaluates and trusts incoming protocol upgrade directives without validating underlying user credentials or session validity. Specifically, when an HTTP request incorporates an Upgrade: websocket header, the middleware completely bypasses the mandatory authentication phase. This security deficit exposes critical backend functionalities to unauthorized external entities.\nThe primary impact of this vulnerability is unauthorized information disclosure. An unauthenticated remote attacker can exploit this flaw to gain unrestricted access to federated search results across all configured remote managed hubs without providing any valid authentication tokens or credentials. The risk implications are severe, as sensitive enterprise or system data aggregated across federated environments can be harvested by malicious actors with network visibility to the target API.\nExploitation requirements are minimal. The attacker does not need prior privileges, valid credentials, or complex session manipulation techniques. The required capability is limited to crafting and transmitting an HTTP request directed at the vulnerable endpoint while appending the specific header that triggers the flawed middleware logic. Remediation requires modifying the authentication middleware to correctly enforce security checks regardless of protocol upgrade headers unless a legitimate, authenticated WebSocket handshake has been successfully completed.",
  "technicalDetails": "The root cause of the vulnerability resides in the authentication middleware of the search-v2-api component. During the request lifecycle processing, the middleware inspects incoming HTTP headers to determine handling paths. Flawed conditional logic within this component is programmed to unconditionally bypass authentication routines if the request headers include an Upgrade: websocket field. This design oversight incorrectly conflates the presence of a protocol upgrade header with a verified authorization state.\nThe vulnerable component is the authentication middleware implemented within the search-v2-api service, specifically impacting access controls applied to HTTP endpoints such as /federated. The affected deployment model involves network-exposed API services that handle federated search queries across multiple configured remote managed hubs. Because the service listens for incoming HTTP traffic, any network-adjacent or remote unauthenticated attacker able to transmit TCP packets to the API endpoint can trigger the flaw.\nThe exploitation method leverages an HTTP POST request targeted at the /federated endpoint. The attack flow proceeds step-by-step as follows: First, the attacker crafts an arbitrary HTTP POST request destined for the sensitive /federated resource, deviating from standard WebSocket connection establishment patterns while still including the malicious Upgrade: websocket header. Second, the request traverses the networking stack and reaches the search-v2-api application layer. Third, the authentication middleware intercepts the request, evaluates the headers, and encounters the Upgrade: websocket string. Due to the insecure conditional check, the middleware short-circuits the standard validation pipeline and marks the request as authorized, completely omitting token verification or session lookups.\nFollowing this bypass, the application processes the POST payload and executes the federated search logic against all configured remote managed hubs as if an authenticated, authorized user had initiated the query. The post-exploitation impact is characterized by mass information disclosure. The API returns aggregated search results containing sensitive organizational data, telemetry, or internal records to the unauthenticated client, violating core confidentiality constraints."
}