{"id":"GHSA-9j7f-3r4p-pwh6","title":"nono-py vulnerable to authorization bypass / policy confusion","summary":"nono-py vulnerable to authorization bypass / policy confusion","severity":"medium","cvss":5.2,"cwe":["CWE-1188"],"vendor":"nono-py","product":"nono-py","ecosystem":"pip","affected":["nono-py <= 0.10.1"],"patched":["nono-py 0.11.0"],"published":"2026-06-26","updated":"2026-06-26","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-9j7f-3r4p-pwh6","references":[{"url":"https://github.com/always-further/nono-py/security/advisories/GHSA-9j7f-3r4p-pwh6"},{"url":"https://github.com/nolabs-ai/nono-py/commit/163fca083a189967b882d1005bfba099fc9a9d63"},{"url":"https://github.com/advisories/GHSA-9j7f-3r4p-pwh6"}],"tags":["ghsa","pip"],"ingestedAt":"2026-06-29T13:24:35.270Z","slug":"GHSA-9j7f-3r4p-pwh6","body":"## Overview\n\nThe python API made a restrictive-looking configuration unsafe by default. A caller could configure only reverse-\nproxy credential routes, put the child in CapabilitySet.proxy_only, and reasonably expect network access to be limited\nto those routes. Instead, because empty allowed_hosts meant allow-all inside nono-proxy, the child could use the local\nproxy as a transparent CONNECT tunnel to non-route nominated hosts (not including metadata endpoints).\n\nThat is an authorization bypass / policy confusion issue:\n\n- Intended policy: route-only proxy access.\n- Actual policy: route-only plus arbitrary transparent CONNECT.\n- Boundary crossed: sandboxed child gains broader outbound network reach than the Python policy appears to grant.\n- Impact depends on environment, but it can allow exfiltration or access to unintended internet/internal services\n  through the unsandboxed proxy.\n\nThis should be classified as medium severity by default, potentially high if users rely on route-only configs for strict egress\ncontrol around untrusted code or sensitive credentials. The fix is security-relevant because it changes the default from\nimplicit allow-all to explicit opt-in.\n\n## Affected packages\n\n- `nono-py <= 0.10.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nono-py 0.11.0`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":28.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}