Routed by ops-warden, which owns the defect and is the affected PEP.
ops-warden ships a flex-auth pre-sign authorization gate and runs with
policy.enabled: false in production (warden.production.example.yaml:22,
policy.py:33). Every production warden sign proceeds with no authorization
decision; possession of the scoped VAULT_TOKEN is the whole model.
That was a known, boring availability blocker (FLEX-WP-0007) until yesterday.
RISK-F-0001 changes its shape: the production config points the gate at
flex-auth.flex-auth.svc.cluster.local:8080 — the exact ClusterIP surface that
authenticates no caller. Enabling the gate before RISK-F-0001 is fixed would
convert an absent control into a false attestation, writing a
policy_decision_id into the signature log for issuances an attacker authorized
by forging the oracle. An authorization check that can be forged is worse than
none, because only one of the two lies in the record afterwards.
severity, disclosure and escalation left unset — risk-nexus's to set.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
tegwick
15b003471e