SEC-ML-001 — Protect AutoML resources
| Field | Value |
|---|---|
| Status | Open finding; source and deployed behavior verified |
| Severity | Critical |
| Components | sparqd/agent-based-ml-platform, sparqd/bff-api, sparqd/platform-stacks, sparqd/oqullus |
| Associated issues | Not opened pending finding review |
Concrete observed case
The AutoML backend has an external ingress but no inbound authentication layer or ownership checks on workflows, history, predictions, generated notebooks, catalog reads, cancellation, or other resource operations. BFF authenticates its routes but generally forwards a caller-selected run ID without proving that the caller owns the run.
Safe unauthenticated GETs to the deployed ingress returned HTTP 200 JSON for a nonexistent workflow, an intentionally nonexistent email's history, and the model catalog. No response content was retained or disclosed.
Expected condition
Expose AutoML only behind an authenticated service boundary and authorize every workflow, attempt, input, output, prediction, notebook, and cancellation against canonical user/workspace membership. Direct calls and BFF calls must enforce the same policy.
Why it matters
Knowing or guessing an identifier, email, or endpoint can bypass the Oqullus access boundary and expose metadata or invoke resource operations. Short workflow IDs make identifier-only authorization especially unsafe.
Existing controls and workarounds
Oqullus normally calls through authenticated BFF routes. Network reachability to the backend remains the only control on direct routes; the assessed ingress is public. Disabling external ingress reduces exposure but does not replace service authentication or resource authorization.
Alternatives considered
- Recommended: require a validated user or service token at AutoML, derive identity from it, and enforce workspace/resource authorization server-side.
- Make AutoML cluster-internal and accept only a strongly authenticated BFF service identity carrying verifiable user context.
- Rely on unguessable IDs — rejected because identifiers are not authorization.
Component involvement
- AutoML owns mandatory inbound authentication and resource checks.
- BFF authorizes the user and forwards verified, not caller-invented, context.
- Platform stacks removes unnecessary public reachability and declares service-to-service policy.
- Oqullus handles deny/not-found outcomes without leaking resource existence.
Reproduction and verification
Follow ML-S002.
Resolution conditions
Close when unauthenticated direct access is denied, cross-user operations are denied consistently, resource IDs are not sufficient authority, and negative authorization tests cover every operation.
Validation and blockers
The deployed failure is confirmed for safe reads. Cross-user and mutation tests were not attempted. Security must approve the authoritative identity and policy.