September Security Repairs: Payload Integrity, IAM Revocation and Console Sharing

This record covers three repairs and their delivery boundaries as of September 16. The identifiers are SILO-local advisory numbers, not CVEs or assigned CVSS scores. The security ledger is the maintained index.

Presigned payload integrity — SN-2026-012

The generic authenticated path could verify a presigned request using a payload hash supplied only in X-Amz-Content-Sha256, yet omit checking the actual body against that hash. A holder of a suitably signed write URL could replace its body. The committed regression demonstrates this with PutBucketPolicy; this is not a claim that an anonymous caller can write arbitrary bucket policies.

c4b5e1cb4 in PR #177 binds body validation to the effective signed hash; mismatches fail with XAmzContentSHA256Mismatch (400). An explicit signed UNSIGNED-PAYLOAD retains its intended meaning. The adjacent signed-field fixes align policy conditions with authenticated values and remove the X-Amz-Signature-Age scratch header. They complement SN-2026-011; they do not establish complete unsigned-header coverage for streaming SigV4.

Review custom signing clients before upgrading. Query hash values take precedence over the fallback header, so changing an unsigned header must not change what policy evaluation or body validation sees.

Durable IAM revocation — SN-2026-013

Delayed replication events, parent recreation and lost deletion history could restore identities or grants an operator had revoked. PR #191 and PR #192 retain source revisions, deletion tombstones and signed parent-revocation boundaries. Older events and child credentials cannot silently cross a retained revocation boundary.

This is a persistent-state change. Upgrade all sites and all nodes sharing an IAM backend together; mixed old/new nodes and rolling downgrade are unsupported. mcli admin cluster iam export omits deletion history and is not a complete recovery backup. Preserve a tested full-backend recovery point and reconcile known earlier revocations. Tombstones have no TTL or automatic compaction.

The design record documents ordering, remaining group-membership limitations and metrics. Follow the upgrade and recovery procedure, including the password-policy pre-step. A revocation can commit and then return HTTP 500 if cleanup fails; the response alone does not prove that the old credential is valid.

Anonymous Console share proxy — SN-2026-014

Jiri Pejchal reported that the unauthenticated shared-download proxy accepted URLs beyond the intended object-download surface on its configured Server origin. This is a same-origin proxy-boundary issue; it is not evidence of arbitrary-host SSRF or bypass of the Server’s S3 authorization.

Console #56 constrains scheme, host and port, requires a valid bucket/object path, rejects system and traversal paths and operation-changing query selectors, disables redirects, and propagates caller cancellation. Accepted object URLs retain their original signed bytes.

Upgrade a standalone installation to Console v2.4.1. Server #209 selects the fixed Console source on main, but installing a separate Console cannot patch the UI and proxy compiled into Server 20260903. Until an appropriate Server artifact is available, limit exposure of the affected Console share endpoint according to the deployment.

Adjacent dependency hardening

Server main upgrades amqp091-go to v1.14.0 for GHSA-6c5v-hqjr-5xxp, fixed upstream in v1.13.0. A malicious AMQP peer can trigger excessive allocation; the SILO path requires a configured AMQP notification target. This Server change also awaits a release after 20260903. pkg v3.14.1 separately ships the JWX JSON encoding update. Component publication and Server dependency adoption are separate facts.