Aias00 opened a new issue, #10956: URL: https://github.com/apache/rocketmq/issues/10956
## Problem The Controller remoting server registers privileged operations such as `UPDATE_CONTROLLER_CONFIG`, `GET_CONTROLLER_CONFIG`, `CLEAN_BROKER_DATA`, broker registration, and broker ID allocation without an authentication/authorization request pipeline or credential-verifying RPC hook. The default Netty bind address is `0.0.0.0`. A reachable network peer can therefore invoke Controller management and state-changing requests without credentials. ## Impact In Controller-mode deployments this can expose Controller configuration and allow unauthorized changes to Controller configuration and Broker failover metadata, affecting cluster integrity and availability. ## Proposed fix - Parse and initialize `AuthConfig` for standalone and embedded Controller startup paths. - Install the existing authentication and authorization request pipelines on the Controller remoting server. - Map Controller request codes to cluster-level authorization contexts. - Add regression coverage that unauthenticated Controller management requests are rejected when authentication is enabled and signed inner-client requests remain accepted. ## Temporary mitigation Bind the Controller to a private interface and restrict network access to intended Brokers and Controller nodes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
