You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "youngkermit8-coder (via GitHub)" <gi...@apache.org> on 2026/08/13 02:18:40 UTC
[I] [Studio][Security] Restrict remote ACL policy discovery to administrators [rocketmq-dashboard]
youngkermit8-coder opened a new issue, #2045:
URL: https://github.com/apache/rocketmq-dashboard/issues/2045
## Problem
`GET /api/acl/remote/rules` is currently treated as an ordinary reader GET by `AuthInterceptor`. The endpoint is not a passive read from Studio's local store: `ApacheAclReadService` resolves the selected instance, uses its stored administrative RocketMQ credentials, connects to every broker, and returns live ACL 2.0 subjects, resource rules, source-IP restrictions, and broker addresses.
A non-admin Studio reader can therefore trigger privileged broker calls with credentials they do not own and enumerate the cluster's authorization policy. Similar GET routes that use saved secrets for LLM model discovery and cloud inventory are already restricted to administrators.
## Expected behavior
Require administrator permission for `/api/acl/remote/rules` (including trailing-slash and matrix-parameter variants) while keeping local, masked ACL list/capability reads available to readers.
## Suggested verification
- a reader receives 403 for remote ACL policy discovery
- an administrator is allowed
- ordinary local ACL GET routes remain reader-accessible
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Restrict remote ACL policy discovery to administrators [rocketmq-dashboard]
Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.
RockteMQ-AI commented on issue #2045:
URL: https://github.com/apache/rocketmq-dashboard/issues/2045#issuecomment-5275470956
**Issue Evaluation**
Category: | Status: **Needs Info**
Thank you for reporting this potential authorization issue. However, after reviewing the current branch of (latest commit: ), the following components referenced in this issue **do not exist** in the codebase:
- endpoint
- class
- The "Studio" module/package
The current and do not contain any route matching or any "remote ACL policy discovery" functionality.
**To proceed with verification, please clarify:**
- [ ] Which version/tag or branch contains the Studio module?
- [ ] Is this a feature under development in a PR or fork?
- [ ] Can you provide a link to the relevant source files?
If this refers to a planned feature, the security concern described (non-admin readers triggering privileged broker calls via stored credentials) is valid and should be addressed before the feature ships.
---
*Automated evaluation by RockteMQ-AI*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Restrict remote ACL policy discovery to administrators [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #2045:
URL: https://github.com/apache/rocketmq-dashboard/issues/2045#issuecomment-5737753040
This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Restrict remote ACL policy discovery to administrators [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #2045: [Studio][Security] Restrict remote ACL policy discovery to administrators
URL: https://github.com/apache/rocketmq-dashboard/issues/2045
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org