Key Vulnerability Information Title: Minder does not sandbox in Rego programs Severity: High (8.5/10) CVE ID: CVE-2025-65109 CVE Weakness: CWE-830: Use of Privilege Management Framework with Insufficient Access Control Policy Affected and Patched Versions Package: ghcr.io/mindersec/minder/helm/minder (Helm) - Affected Versions: 0.20241106.3386+ref.2507dbf0 - Patched Versions: >=0.20250203.3849+ref.fdc94f Package: github.com/mindersec/minder (Go) - Affected Versions: v0.0.72-v0.0.83 - Patched Versions: >=v0.0.84 ###impact Minder users may fetch content in the context of the Minder server, which may include URLs the user would not normally have access to, such as if the Minder server is behind a firewall or other network partition. Workarounds Avoid deploying Minder with access to sensitive resources. Be cautious of systems that may be accessed, such as OpenFGA or Keycloak. Severity Metrics Exploitability: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: Low - User Interaction: None Impact: - Confidentiality: High - Integrity: Low - Availability: Low