- Shipped
- August 3, 2026 at 2:32 AM UTC
- Author
- Kamo
- Commit
- 06db7db
SecurityService now runs a fetcher whose target URL is chosen by an untrusted party — a BIMI record is DNS content published by whoever owns a sending domain, and anyone becomes a sending domain by emailing a tenant. Nothing in this cluster constrained where such a request could go: Redis answers unauthenticated on 6379, MinIO on 9000 with root credentials, CockroachDB on 26257, and the node metadata endpoint is reachable from any pod. The resolver enforces its own controls in code, and those stay the primary defence because they are the only layer that understands DNS rebinding. This is the second one, so a bug there still cannot reach a private address. Deliberately allow-most rather than allow-list. These services legitimately reach hosts, so enumerating destinations would be unmaintainable and would break quietly. Instead it permits the public internet with every private range excepted, then re-permits the specific in-cluster ports actually needed. Scoped to the pods that perform untrusted fetches — applying it namespace-wide would cut off services whose egress has never been audited. The Redis change is a comment and a databases bump, not a behaviour change. It records why the sender-avatar cache stores only short metadata strings: maxmemory 2gb with allkeys-lru evicts across the whole instance, and DB 0 holds every live session, so a bulk byte cache here would sign users out at random under pressure and be misdiagnosed for days.