# GHSA-9j7f-3r4p-pwh6: nono-py vulnerable to authorization bypass / policy confusion

> A sandboxed child process can bypass route restrictions to access arbitrary network hosts via the local proxy, potentially leading to data exfiltration.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 26 Jun 2026

## What is GHSA-9j7f-3r4p-pwh6?

GHSA-9j7f-3r4p-pwh6 is an authentication bypass vulnerability in nono-py, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

The python API made a restrictive-looking configuration unsafe by default. A caller could configure only reverse-
proxy credential routes, put the child in CapabilitySet.proxy_only, and reasonably expect network access to be limited
to those routes. Instead, because empty allowed_hosts meant allow-all inside nono-proxy, the child could use the local
proxy as a transparent CONNECT tunnel to non-route nominated hosts (not including metadata endpoints).

That is an authorization bypass / policy confusion issue:

- Intended policy: route-only proxy access.
- Actual policy: route-only plus arbitrary transparent CONNECT.
- Boundary crossed: sandboxed child gains broader outbound network reach than the Python policy appears to grant.
- Impact depends on environment, but it can allow exfiltration or access to unintended internet/internal services
  through the unsandboxed proxy.

This should be classified as medium severity by default, potentially high if users rely on route-only configs for strict egress
control around untrusted code or sensitive credentials. The fix is security-relevant because it changes the default from
implicit allow-all to explicit opt-in.

## Which versions are affected by GHSA-9j7f-3r4p-pwh6?

2 open source packages ship an affected version, including nono-py.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `nono-py` | PyPI | All versions | 0.11.0 |
| `nono-py` | PyPI | All versions | 0.11.0 |

## How do I fix GHSA-9j7f-3r4p-pwh6?

Upgrade nono-py to 0.11.0 or later.

## Is GHSA-9j7f-3r4p-pwh6 being exploited?

There is no known exploitation of GHSA-9j7f-3r4p-pwh6 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-9j7f-3r4p-pwh6 and fix it if it is affected.

What it is: GHSA-9j7f-3r4p-pwh6 is an authentication bypass vulnerability in nono-py, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-9j7f-3r4p-pwh6 in the wild and no public exploit code.

Affected packages and fixed versions:
- nono-py (PyPI): affected all versions; fixed in 0.11.0
- nono-py (PyPI): affected all versions; fixed in 0.11.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-9j7f-3r4p-pwh6/ (Markdown: https://insights.sbomify.com/GHSA-9j7f-3r4p-pwh6/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-9j7f-3r4p-pwh6

---
From sbomify Insights: https://insights.sbomify.com/GHSA-9j7f-3r4p-pwh6/
Summaries are generated and may contain mistakes; the official description above is the record.