Security

Missing Authentication for Critical Function (CWE-306)

A weakness class in which software performs a sensitive operation without verifying the caller's identity at all, as opposed to checking it incorrectly. Typically found in management APIs, helper services and internal interfaces that were assumed to be unreachable by untrusted callers.

Deep dive

Learn Article

How a Database Cluster Manager's REST API Becomes a Command-Execution Path

HA database managers expose failover, restart, reinitialize and config rewrite over HTTP, and often ship with auth off. Why that API is a code-execution surface, using Patroni's own docs as the guide.

intermediate 6 min read

Back to glossary