{"answers":{"affected":"3 open source packages ship an affected version, including github.com/filecoin-project/curio.","exploited":"There is no known exploitation of GHSA-gj6x-q8rh-wj6x in the wild and no public exploit code.","fix":"Upgrade github.com/filecoin-project/curio to 1.27.3-rc2 or later.","what":"GHSA-gj6x-q8rh-wj6x is a vulnerability in github.com/filecoin-project/curio, published on 26 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-gj6x-q8rh-wj6x and fix it if it is affected.\n\nWhat it is: GHSA-gj6x-q8rh-wj6x is a vulnerability in github.com/filecoin-project/curio, published on 26 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-gj6x-q8rh-wj6x in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/filecoin-project/curio (Go): affected from 1.24.3; fixed in 1.27.3-rc2\n- github.com/filecoin-project/curio (Go): affected from 1.24.3; fixed in 1.27.3-rc2\n- github.com/filecoin-project/curio (Go): affected from 1.24.3; fixed in 1.27.3-rc2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-gj6x-q8rh-wj6x/ (Markdown: https://insights.sbomify.com/GHSA-gj6x-q8rh-wj6x/index.md)","id":"GHSA-gj6x-q8rh-wj6x","markdown":"https://insights.sbomify.com/GHSA-gj6x-q8rh-wj6x/index.md","name":"GHSA-gj6x-q8rh-wj6x","record":{"aliases":["GO-2026-4568"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["data_read","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Filecoin Curio node","requires_auth":"low_privilege","summary":"Authenticated attackers can extract database credentials from verbose HTTP error responses in Curio, enabling direct database access and potential privilege escalation.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nMultiple HTTP handlers in Curio passed raw database error messages to HTTP clients via `http.Error()`. When the PostgreSQL/YugabyteDB driver (pgx) returned errors, these could contain the database connection string — including hostname, port, username, and password. Additionally, the internal connection string was constructed with the plaintext password embedded in the URL, which was also included in startup error messages and could surface in logs.\n\n## Details\n\nThree components were affected:\n\n1. **PDP handlers** (`pdp/handlers.go`) — 18+ HTTP error paths passed `err.Error()` directly to HTTP responses. While these endpoints require ECDSA JWT authentication, an authenticated client (e.g., a FilPay service) that triggered a database error would receive the raw pgx error in the HTTP response body. Present since PDP was introduced in v1.25.1.\n\n2. **Market mk12 deal status** (`market/mk12/mk12_utils.go`) — The `GetDealStatus` handler included `err.Error()` in error responses: `\"failed to query the db for deal status: %s\"`. Present since v1.24.3.\n\n3. **Market mk20 auth middleware** (`market/mk20/http/http.go`) — Authentication error responses included `err.Error()`, potentially leaking database error details during auth flows. Present since v1.27.2.\n\n### Root Cause\n\nThe database connection string was constructed as:\n```\npostgresql://username:password@host:port/database?...\n```\nThe plaintext password was embedded directly in the URL. When pgx returned connection or query errors, the error text could contain fragments of this connection string. HTTP handlers forwarded these errors verbatim to clients.\n\n## Impact\n\nAn attacker with network access to Curio's PDP or Market HTTP endpoints and valid authentication credentials could intentionally trigger database errors (e.g., by sending malformed requests that cause SQL failures) and extract the YugabyteDB connection credentials from the error response. With these credentials, the attacker could directly access the database, which serves as Curio's control plane.\n\nPer Curio's [security boundary documentation](https://github.com/filecoin-project/curio/blob/main/documentation/en/design/README.md#security-boundary), these endpoints are expected to be on a trusted network. However, defense-in-depth requires that credentials are never exposed through HTTP responses regardless of network trust assumptions.\n\n## Remediation (PR #919)\n\n1. **Connection string password masking:** The password in the connection string is replaced with `********`. The real password is set separately via `cfg.ConnConfig.Password`, so it never appears in error messages or logs.\n\n2. **HTTP handler sanitization:** All affected handlers now log the detailed error server-side and return a generic error message to the HTTP client.\n\n3. **Error filter (`errFilter`):** A new function in the database layer detects and redacts any error messages containing keywords like \"password\", \"host\", \"port\", or \"://\" before they can propagate.\n\n4. **Prometheus metrics cleanup:** Database connection metrics that could expose connection details were removed from the metrics endpoint.\n\n5. **Security boundary documentation:** A new section documents what Curio expects operators to secure.\n\n## Resources\n\n- Fix: https://github.com/filecoin-project/curio/pull/919\n- Patched release: v1.27.3-rc2","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Curio exposes database credentials to users with network access through verbose HTTP error responses","id":"GHSA-gj6x-q8rh-wj6x","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["1.27.3-rc2"],"introduced":["1.24.3"],"last_affected":[],"package":"github.com/filecoin-project/curio","purl":null,"source":"GHSA-gj6x-q8rh-wj6x"},{"ecosystem":"Go","fixed":["1.27.3-rc2"],"introduced":["1.24.3"],"last_affected":[],"package":"github.com/filecoin-project/curio","purl":"pkg:golang/github.com/filecoin-project/curio","source":"GHSA-gj6x-q8rh-wj6x"},{"ecosystem":"Go","fixed":["1.27.3-rc2"],"introduced":["1.24.3"],"last_affected":[],"package":"github.com/filecoin-project/curio","purl":"pkg:golang/github.com/filecoin-project/curio","source":"GO-2026-4568"}],"products":null,"published":"2026-02-26","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated attackers can extract database credentials from verbose HTTP error responses in Curio, enabling direct database access and potential privilege escalation.","url":"https://insights.sbomify.com/GHSA-gj6x-q8rh-wj6x/"}