# Unauthenticated inline config auth bypass

Unauthenticated endpoints that accept inline backend config or set auth flags before verifying credentials

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; latest 2026-06-16. Updated 2026-10-25._

## How it works
An endpoint treats attacker-supplied input as trusted configuration, or sets an authentication flag before the credential check completes. In both cases a downstream check trusts a value the attacker controls. The assumption that breaks: that "this request is authenticated" or "this remote is a known, safe backend" is established before the untrusted input is validated. Because the flag or config is consumed later by code that assumes it is already safe, the check never actually gates the dangerous action.

## Where it shows up
- RC/API endpoints registered without an auth requirement that call a resolver accepting inline backend definitions (object-valued config, not just a name) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-jfwf-28xr-xw6q.md).
- File-serving routes that parse `remote:path` from the URL and pass the remote string into normal backend init [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-qw24-gh76-8rvv.md).
- Auth code that sets a request/session flag (e.g. `isAPIRequest`) as soon as certain headers are present, before HMAC/signature verification [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-fcrh-fqxh-6fx6.md).
- Endpoints with a commented-out or missing gatekeeper, or a TODO about logged-out access [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-fcrh-fqxh-6fx6.md).
- Backend init that runs commands from config (e.g. `bearer_token_command` via exec) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-jfwf-28xr-xw6q.md).

## How to review
The invariant: no dangerous action may run until the credential check has returned success, and no attacker string may be interpreted as backend config. Concretely: for every unauthenticated route, trace the handler to its sinks and confirm auth is enforced at the route, not assumed downstream. Confirm auth flags are set only after signature verification succeeds. Confirm inline/object config and `global.*` overrides are rejected on any path reachable without auth. For `remote:path` parsing, verify the remote is resolved against a pre-approved list, not instantiated from the URL.

## Variants seen
- Missing `AuthRequired` on an RC endpoint reaching inline backend config and init-time command execution [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-jfwf-28xr-xw6q.md).
- Auth flag set before HMAC check, short-circuiting token validation and enabling SSRF [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-fcrh-fqxh-6fx6.md).
- File-serving path passing inline remote into backend init, bypassing an earlier fix [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-qw24-gh76-8rvv.md).

## Why fixes fail
E3 shows a prior fix (CVE-2026-41179) that blocked one path but left the `--rc-serve` route still feeding inline remote config into backend init. Fixes that patch a single endpoint rather than the shared resolver leave sibling paths open.

## Impact and severity
Unauthenticated remote command execution as the service user [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-jfwf-28xr-xw6q.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-qw24-gh76-8rvv.md) and unauthenticated SSRF to internal/metadata endpoints [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-fcrh-fqxh-6fx6.md). Severity is high: no credentials needed, single request. Worse when the service runs with broad privileges or reaches cloud metadata.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-jfwf-28xr-xw6q.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-fcrh-fqxh-6fx6.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-qw24-gh76-8rvv.md