Epic: Critical Security Updates Q2/3 2026

Overview

Tracking all active security vulnerabilities flagged by CodeQL static analysis and CVE databases. Each row is a linked sub-issue.

Status as of 2026-09-17: Alert #5 (path injection in MockExternalPayloadStorage) is fixed — PR #723 merged to main on 2026-07-08 with a canonical-path check. Its CodeQL alert still displays "open" because the code-scanning workflow hasn't re-run over that path (last scan 2024-05-12); it will auto-close on the next scan. Everything else remains open, and two new GitHub Actions permission alerts (#31, #32) have appeared since the last update.

Code vulnerabilities (CodeQL)

Alert	Severity	File	Issue	Status
#2 SSRF	critical	http-task/.../HttpTask.java:175	#1018	⏳ Open — restTemplate.exchange(input.getUri(), …) with no host restriction; needs allowlist/denylist
#6 ReDoS	high	core/.../ParametersUtils.java:56,258	#1638	⏳ Open — backtracking PATTERN run on every task param; reachable from worker output
#4 Path injection	high	core/.../DummyPayloadStorage.java:95	#1639	⏳ Open — new File(payloadDir, path) unvalidated; dev-mode only
#3 ReDoS	high	postgres-persistence/.../PostgresIndexQueryBuilder.java:69	#1640	⏳ Open — O(n²) regex + Pattern compiled per-call; low real risk
#23 Identity replacement	medium	ui-next/.../errorInspector/state/helpers.ts:194	#1642	⏳ Open — no-op String.replace; intended transform not applied
#5 Path injection	high	test-harness/.../MockExternalPayloadStorage.java:96	PR #723	✅ Fixed & merged 2026-07-08 (CodeQL alert stale, will auto-close)

GitHub Actions — missing workflow permissions

Tracked in #1641 · rule actions/missing-workflow-permissions · medium

Alert	File	Line
#14	.github/workflows/ci.yml	314
#17	.github/workflows/ci.yml	39
#29	.github/workflows/ci.yml	134
#31 (new)	.github/workflows/ci.yml	205
#32 (new)	.github/workflows/ci.yml	227
#24	.github/workflows/debug-docker-credentials.yml	8

Dependency / CVE workstreams

Issue	Scope	Status
#643	[email protected] (ui/) → 8.x — CVE-2024-37890	⏳ Open
#1528	Shaded/image CVEs (netty, micrometer, elasticsearch, perl, libssh2, nginx, …); follow-on to #1490	⏳ Open

@peter-mcclonski's note about transitive/shaded dependency CVEs (e.g. spring-core 6.1.19 → 6.2.11) is folded into #1528 — the standing home for dependency-bump security work.

Legend

• ✅ Fixed / merged
• Ready for review (needs approval/merge)
• In progress
• ⏳ Open (work not yet started)