From fffa62179769e7e2842635a87df701be417a1cb2 Mon Sep 17 00:00:00 2001 From: Codescribe Date: Sat, 28 Mar 2026 20:35:23 -0400 Subject: [PATCH] security: default metrics server to loopback Fixes unauthenticated metrics exposure by defaulting to 127.0.0.1 when no host is provided. Logs a warning when bound to non-loopback addresses. --- cmd/cli/metrics.go | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/cmd/cli/metrics.go b/cmd/cli/metrics.go index 330918c..7eb394f 100644 --- a/cmd/cli/metrics.go +++ b/cmd/cli/metrics.go @@ -120,6 +120,22 @@ func (p *prog) runMetricsServer(ctx context.Context, reloadCh chan struct{}) { } addr := p.cfg.Service.MetricsListener + if addr != "" { + host, port, err := net.SplitHostPort(addr) + if err != nil { + mainLog.Load().Warn().Err(err).Msgf("Invalid metrics listener address (%s); expected host:port", addr) + } else { + if host == "" { + host = "127.0.0.1" + addr = net.JoinHostPort(host, port) + } + ip := net.ParseIP(host) + if (ip != nil && !ip.IsLoopback()) || (ip == nil && host != "localhost") { + mainLog.Load().Warn().Msgf("Metrics server is bound to a non-loopback address (%s). This exposes sensitive data without authentication.", addr) + } + } + } + ms, err := newMetricsServer(addr, reg) if err != nil { mainLog.Load().Warn().Err(err).Msg("Could not create new metrics server")