RockteMQ-AI commented on issue #4281: URL: https://github.com/apache/rocketmq-dashboard/issues/4281#issuecomment-5655088052
**Issue Evaluation** Category: `type/bug` | Status: **Confirmed** | Severity: **High** This is a security issue. `GET /api/k8s-certs` returns `keyPem` (TLS private keys) to any authenticated user, including reader-role users. The `AuthInterceptor` whitelist does not include this path, so the admin-only GET restriction is not applied. This should be prioritized. The immediate fix is to either: 1. Add `/api/k8s-certs` to the `isAdminOnlyGetPath` whitelist, or 2. Strip `keyPem` from the response for non-admin users. Option 2 is preferable as it follows the principle of least privilege — reader users should never see private key material regardless of the endpoint's authorization model. --- *Automated evaluation by github-manager* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
