p PatchFirst

GHSA-7f4h-6264-89fr

GHSA-7f4h-6264-89fr · axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

## Summary The AxonFlow SDK's `WebhookSubscription` (or equivalent) type did not expose the HMAC-SHA256 signing key returned by the platform's `CreateWebhook` endpoint. Without access to the secret through the typed SDK API, callers had no path to verify the `X-AxonFlow-Signature` header on incoming webhook deliveries. Affected callers had two unsatisfactory options: 1. Skip signature verification entirely — accepting any payload from any source that knew the webhook URL. 2. Hand-parse the raw HTTP JSON response to extract the secret, bypassing the type-safe SDK surface. This advisory is filed across all four AxonFlow SDKs (Go, Python, TypeScript, Java) because the same defect and the same fix landed in each. ## Affected versions Versions 6.6.2 and below. ## Impact A webhook receiver using the SDK's typed API to handle inbound deliveries had no path to authenticate the source of incoming payloads. An attacker who learned the webhook URL — through misconfiguration, log leakage, observable network traffic during setup, or any other discovery channel — could forge webhook deliveries indistinguishable from legitimate ones, causing the receiving application to act on fabricated events (e.g. simulated approval-granted callbacks, simulated policy-decision callbacks, simulated step-completion callbacks). ## Remediation Upgrade to the patched version listed in Vulnerabilities below. The signing key is now exposed on the `WebhookSubscription` response type returned by `CreateWebhook`. Implementations should: 1. Persist the secret returned by `CreateWebhook` securely (it is only returned once, at create time). 2. On each incoming webhook delivery, compute `HMAC-SHA256(secret, raw_body)` and compare it in constant time against the `X-AxonFlow-Signature` header. 3. Reject any delivery whose signature does not match. ## Credit Identified by AxonFlow internal security review during the April 2026 quality-freeze epic.

CVSS 5.9 · Moyenne · Correctif disponible

Publication
Mise à jour

Pile logicielle: python

Produits et versions concernés

  • axonflow PyPI

    Versions du logiciel
    • 0.1.0
    • 0.10.0
    • 0.10.1
    • 0.11.0
    • 0.12.0
    • 0.13.0
    • 0.14.0
    • 0.2.0
    • 0.3.0
    • 0.3.1
    • 0.4.0
    • 0.5.0
    • 0.6.0
    • 0.7.0
    • 0.8.0
    • 0.9.0
    • 0.9.1
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.7.0
    • 1.7.1
    • 3.0.0
    • 3.1.0
    • 3.2.0
    • 3.3.0
    • 3.3.1
    • 3.4.0
    • 3.5.0
    • 3.6.0
    • 3.7.0
    • 3.8.0
    • 4.0.0
    • 4.1.0
    • 4.2.0
    • 4.2.1
    • 5.0.0
    • 5.1.0
    • 5.2.0
    • 5.3.0
    • 5.4.0
    • 6.0.0
    • 6.1.0
    • 6.2.0
    • 6.3.0
    • 6.4.0
    • 6.5.0
    • 6.6.0
    • 6.6.1
    • 6.6.2
    Plages de versions concernées
    • ECOSYSTEM: < 6.7.0

    Mettez à jour vers 6.7.0

Sources originales

Vérifiez votre serveur →