Executive brief
Mythic, a command-and-control framework used for security operations, contains a flaw that allows users to view sensitive data from projects they are not authorized to see. An authenticated user, even with limited view-only permissions, can access build logs and configuration details for every operation on the server. This could lead to the exposure of encryption keys, server addresses, and other internal operational details belonging to different teams or clients.
Technical details
A logic error exists in the Hasura row-level permission metadata for the 'payload_build_step' table. The filter uses an '_or' condition where the first branch checks if 'payloadtype_id' is not null; since this is a non-null foreign key, the condition is always satisfied. This causes Hasura to short-circuit and ignore the second branch intended to restrict access to the user's specific operation ID. Consequently, any authenticated user (operator or spectator) can query the GraphQL API to retrieve 'step_stdout', 'step_stderr', and other columns for all operations on the server. The issue is fixed in version 3.4.0.60.
Affected products
- its-a-feature Mythic before 3.4.0.60
Timeline
- 2026-06-20: disclosed: Issue reported on GitHub by researcher George Chen
- 2026-06-21: patched: Version 3.4.0.60 released with fix
- 2026-06-29: advisory: NVD and VulnCheck advisories published