Executive brief
disconf is an open-source distributed configuration management platform used by organizations to centrally store and serve application configuration data. A critical authentication bypass vulnerability allows unauthenticated attackers to directly access all configuration items and files through four API endpoints without login credentials. In practice, this exposes sensitive data such as database passwords, API keys, Redis credentials, and other secrets stored in plaintext within the configuration center, enabling attackers to compromise backend systems and steal credentials at scale.
Technical details
The vulnerability is an authentication bypass caused by explicit whitelisting of four API endpoints in the LoginInterceptor without proper access controls. The endpoints /api/config/item, /api/config/file, /api/config/list, and /api/config/simple/list are annotated with @NoAuth and are excluded from the login check mechanism, allowing any network-accessible attacker to enumerate and retrieve all configuration data. No authentication or special privileges are required; an attacker simply crafts HTTP GET requests with application, environment, and version parameters to exfiltrate the complete configuration, including plaintext credentials and secrets. This affects disconf 2.6.36 and earlier versions, with patches expected in future releases.
Affected products
- Baidu disconf 2.6.36 and earlier
Timeline
- 2026-08-26: disclosed