---
id: GHSA-9j7f-3r4p-pwh6
title: nono-py vulnerable to authorization bypass / policy confusion
summary: nono-py vulnerable to authorization bypass / policy confusion
severity: medium
cvss: 5.2
cwe:
  - CWE-1188
vendor: nono-py
product: nono-py
ecosystem: pip
affected:
  - nono-py <= 0.10.1
patched:
  - nono-py 0.11.0
published: '2026-06-26'
updated: '2026-06-26'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-9j7f-3r4p-pwh6'
references:
  - url: >-
      https://github.com/always-further/nono-py/security/advisories/GHSA-9j7f-3r4p-pwh6
  - url: >-
      https://github.com/nolabs-ai/nono-py/commit/163fca083a189967b882d1005bfba099fc9a9d63
  - url: 'https://github.com/advisories/GHSA-9j7f-3r4p-pwh6'
tags:
  - ghsa
  - pip
ingestedAt: '2026-06-29T13:24:35.270Z'
---

## Overview

The python API made a restrictive-looking configuration unsafe by default. A caller could configure only reverse-
proxy credential routes, put the child in CapabilitySet.proxy_only, and reasonably expect network access to be limited
to those routes. Instead, because empty allowed_hosts meant allow-all inside nono-proxy, the child could use the local
proxy as a transparent CONNECT tunnel to non-route nominated hosts (not including metadata endpoints).

That is an authorization bypass / policy confusion issue:

- Intended policy: route-only proxy access.
- Actual policy: route-only plus arbitrary transparent CONNECT.
- Boundary crossed: sandboxed child gains broader outbound network reach than the Python policy appears to grant.
- Impact depends on environment, but it can allow exfiltration or access to unintended internet/internal services
  through the unsandboxed proxy.

This should be classified as medium severity by default, potentially high if users rely on route-only configs for strict egress
control around untrusted code or sensitive credentials. The fix is security-relevant because it changes the default from
implicit allow-all to explicit opt-in.

## Affected packages

- `nono-py <= 0.10.1`

## Remediation

Upgrade to a patched release:

- `nono-py 0.11.0`