From 9709125307c18a543b5cc171571ce07dd0549abd Mon Sep 17 00:00:00 2001 From: anupamme Date: Thu, 3 Sep 2026 10:41:53 +0000 Subject: [PATCH] fix: V-002 security vulnerability Automated security fix generated by OrbisAI Security --- plugins/keyrotation/handlers.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/plugins/keyrotation/handlers.py b/plugins/keyrotation/handlers.py index 0c26cbcb..f3de490a 100644 --- a/plugins/keyrotation/handlers.py +++ b/plugins/keyrotation/handlers.py @@ -228,6 +228,19 @@ async def post(self): public_key = body.get("public_key", "").strip() second_factor = body.get("second_factor", "") relationship = body.get("relationship", "") or "" + private_key = body.get("private_key", "").strip() + + # Ownership check: only the node that controls the configured + # private_key may trigger a rotation. Knowledge of public_key and + # second_factor alone is not sufficient proof of identity ownership. + node_private_key = getattr(self.config, "private_key", "") or "" + if not private_key or not _hmac_safe.compare_digest( + private_key, node_private_key + ): + self.set_status(401) + return self.render_as_json( + {"status": False, "message": "invalid private_key"} + ) if not public_key or not second_factor: self.set_status(400)