Missing Authentication for Critical Function Affecting clauster package, versions [,0.12.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Missing Authentication for Critical Function vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-CLAUSTER-17950948
- published11 Jul 2026
- disclosed10 Jul 2026
- creditUnknown
Introduced: 10 Jul 2026
CVE NOT AVAILABLE CWE-306 (opens in a new tab)How to fix?
Upgrade clauster to version 0.12.0 or higher.
Overview
clauster is a Self-hosted web UI for spawning and managing Claude Code remote-control bridges on a remote host.
Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the authentication process. An attacker can gain unauthorized access to the dashboard and its API by sending requests to a non-loopback deployment when auth.enabled is unset, even if a password is configured. This allows full control over dashboard features, including listing projects, spawning or stopping remote-control bridges, editing files, reading logs, and potentially executing code in project directories. This is only exploitable if the service is bound to a non-loopback address, auth.enabled is unset or set to false, and either auth.password_required: true or auth.reverse_proxy.enabled: true is configured.
Workaround
This vulnerability can be mitigated by setting auth.enabled: true in the configuration or binding the service to a loopback address.