myxce/.wolf/bugs/bug-1947.md

id	status	status_updated	status_note	component	severity	timestamp	last_seen	occurrences	files	tags	related	fix_commits	gitea_issue	gitea_synced_status	gitea_synced_hash
bug-1947	fixed	2026-10-10		apiserver	security	2026-10-10T08:15:04Z	2026-10-10T08:15:04Z	1	src/frontend/apiserver/backend/auth/config_file.go src/frontend/apiserver/config/auth.yaml	apiserver security auth		f91642db	378	fixed	fa1b59de0894

bug-1947: apiserver config-file auth compares plaintext passwords with != and ships admin/admin defaults

Description

Observed: (source reading, .kiro/reviews/project-gap-review-2026-10-10.md (P0); to be confirmed by a failing test before the fix) backend/auth/config_file.go:60 compares the stored plaintext password with !=; config/auth.yaml:12-21 ships admin/admin and user1/user1.

Expected: Stored passwords are hashed and compared in constant time; no default credentials are shipped active. Impact: Security: password disclosure from the config file, timing side channel, and known default credentials. Found by: review: .kiro/reviews/project-gap-review-2026-10-10.md (P0)

Environment

• OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
• libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
• Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
• Build: asan (xce.build)
• Code: scheduler-framework @ 94472ee3-dirty
• Deployment: any (found by source reading; the failing test that confirms it is named in Verification)

Reproduction

1. Read config/auth.yaml; log in as admin/admin on a default deployment.

• Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
• Evidence: the code sites quoted in Description; no logs kept.

Root cause

ConfigFileProvider.Authenticate (backend/auth/config_file.go) compared the stored plaintext with !=; auth.yaml shipped plaintext defaults.

Fix

bcrypt hashes accepted; plaintext entries still work but compare in constant time; unknown users cost the same bcrypt work; SecurityWarnings() + startup warnings for plaintext entries and active shipped default passwords; auth.yaml/auth.yaml.example ship bcrypt hashes of the same dev passwords (dev tooling such as tests/regression/run.sh keeps working); tools/encrypt -action=hash; golang.org/x/crypto/bcrypt vendored from the already pinned x/crypto v0.23.0.

Verification

• Test: TestConfigFileProvider_BcryptPassword, TestShippedAuthConfig_HashedDefaults, TestConfigFileProvider_SecurityWarnings (backend/auth/config_file_test.go): RED (e.g. the stored hash itself was accepted as a password; shipped password is not a bcrypt hash), GREEN after.
• Suites: xce-build.sh all asan xce.build --incremental on the merged branch, 2026-10-10: all C suites Ok 155 / Fail 0, frontend Go unit tests ok, xceadmin tests ok; apiserver CGO_ENABLED=0 go test ./... (incl. middleware, router, cmd) ok
• Live: n/a: unit/fixture-level verification only; no live deployment was run (follow-up)

References

• Fix commit: f91642db (on scheduler-framework; worker-branch original in the merge)
• Review: .kiro/reviews/project-gap-review-2026-10-10.md