Credential references are scoped per driver type, not per instance: a Designer can capture another Galaxy instance's mxaccessgw key #835
Assignees
dohertj2 (dohertj2)
Clear assignees
dohertj2 (dohertj2)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: dohertj2/lmxopcua#835
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Residual from #815's review. Galaxy references are restricted to
secret:galaxy/…/secret:otopcua/galaxy/…/env:OTOPCUA_GALAXY_…/env:GALAXY_MXGW_…, but any Galaxy driver may name any key in that namespace. A Designer can create a Galaxy driver with an endpoint they control andsecret:galaxy/<other-instance>/apikey, then Test Connect / browse / deploy: the admin or driver node resolves the other instance's mxaccessgw API key and sends it to that endpoint. That key gives direct gateway read/write/subscribe on that Galaxy, bypassing OtOpcUa's data-plane ACLs — fleet-wide if the secret store replicates.Options: bind references to the instance (e.g.
secret:galaxy/{DriverInstanceId}/…, or an allowlist of endpoint+key pairs), or require the endpoint host to match an approved list per key. Cross-repo: mxaccessgw key scoping could also limit blast radius.Fixed (
63331b04, review fixes271b96a6). Pushed to master ind1b6cad2. Asecret:reference whose first segment after the namespace (galaxy/<X>,otopcua/galaxy/<X>,opcuaclient/<X>, Heidenhain likewise) names ANOTHER same-type driver's id or name is refused at save, deploy (CredentialReferenceOtherInstance), Test Connect and browse. Shared names that no instance uses still work. Test Connect and browse decide ownership server-side: the named driver is the owner only if every endpoint value in the submitted config is already stored on it, so typing your own host into another driver's modal no longer borrows its key. Each Test Connect/browse with an in-scope reference writes aCredentialUseaudit record (user, driver, outcome, endpoint host — never the reference). Independent security review: no bypass found.Upgrade note: two same-type drivers sharing a name can't use name-scoped secrets; use id-scoped ones. Follow-ups: #848 #849.