28Hus commented on issue #8225: URL: https://github.com/apache/incubator-seata/issues/8225#issuecomment-5658223273
> https://seata.apache.org/zh-cn/docs/security/secret-key [#8086](https://github.com/apache/incubator-seata/pull/8086) Hello, we received similar reports as early as last year. This product has strict requirements regarding its deployment environment. Users are required to deploy it properly within the designated internal network, and it must never be exposed to the public Internet. @funky-eyes Hello, Thank you for reviewing the report. I agree that administrators should replace the default value, and I am not suggesting that all Seata installations are affected. However, a publicly known value shipped as an active authentication key should not be dismissed as only an operational error. The current Seata NamingServer documentation itself publishes a fixed token-signing key and only recommends that users change it. In the documented NamingServer deployment path, this value is used for JWT signing and verification. The issue was reproduced against the tested 2.x version, where a token signed with the published key was accepted by an authenticated endpoint. There are also several relevant Apache precedents. Apache OFBiz addressed CVE-2026-31986 by removing fixed JWT and encryption keys from the shipped configuration and adding automatic generation of cryptographically secure keys. Apache HugeGraph lists CVE-2024-43441 for a fixed JWT token secret. Apache Superset CVE-2023-27524 specifically affected installations that had not changed the documented default SECRET_KEY. Apache Shiro also addressed CVE-2016-4437 when its remember-me cipher key had not been explicitly configured. These cases show that a documentation warning does not automatically make a reusable security default acceptable. The issue is limited to deployments that retain the publicly known signing key; deployments using a unique key are not exposed to this specific problem. A secure fix would be to remove the reusable default and require or generate a unique high-entropy key during installation. best regards, -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
