absurd: unauthenticated Habitat dashboard on all interfaces

No upstream patch is available yet. Anyone running Habitat should restrict who can reach it until an official fix is released.

1. Bind Habitat to loopback explicitly: start it with --listen 127.0.0.1:7890 or set HABITAT_LISTEN=127.0.0.1:7890.
2. If the dashboard must be reachable from other machines, put it behind an authenticating reverse proxy that also only accepts the expected Host value, and firewall TCP 7890 from everything else.
3. Stop Habitat when you are not using it, since a loopback bind alone does not stop DNS rebinding from a page open in your browser.
4. If modifying the code, apply the small patch from our report: change defaultListenAddress in habitat/internal/config/config.go to 127.0.0.1:7890 and add a middleware in habitat/internal/server/server.go that rejects requests whose Host header is not an expected local or operator-configured name.
5. Avoid placing long-lived secrets in task parameters or headers; pass references and load the secret inside the worker instead.

Habitat is documented as being served at http://localhost:7890, which suggests it is local only. In Go, the default listen address :7890 binds every interface, so any host on the same LAN, VPC, container network or node can call the API with no credentials. The JSON API returns task params, headers, retry strategy, checkpoint state and event payloads verbatim, and POST /api/tasks/retry lets the caller re-enqueue or extend attempts on arbitrary tasks.

Because there is no Host allowlist, a web page the operator visits can rebind a hostname it controls to the dashboard's address and then read the API as if it were same-origin. That reaches the data and the retry action even on a deployment bound to loopback. A working exploit is withheld.

The listen address defaults to :7890 and is passed straight to net.Listen. The route table wires every API handler, including the retry action, with no authentication, and the only wrappers are request logging and base-path rewriting, neither of which checks Host or Origin:

• Default listen address on all interfaces: habitat/internal/config/config.go#L15
• Listener opened on the configured address: habitat/internal/server/server.go#L66-L76
• Unauthenticated API routes, including POST /api/tasks/retry: habitat/internal/server/server.go#L113-L130
• Logging and base-path wrappers with no Host or Origin check: habitat/internal/server/server.go#L103-L111 and server.go#L132-L173

1. 2026-07-12Vulnerability reported privately via GitHub Security Advisory (GHSA-6wff-4mpf-gpj8).
2. 2026-08-12First follow-up comment posted on the advisory (31 days in triage).
3. 2026-08-29Second follow-up comment posted on the advisory (48 days in triage).
4. 2026-09-17Third follow-up comment posted on the advisory (67 days in triage).
5. 2026-10-20Coordinated-disclosure notice posted on the advisory after the 90-day window passed, setting a deadline of 2026-11-03.
6. 2026-11-03Coordinated-disclosure deadline expired with no response from the maintainer; sink verified still present at HEAD 3cfc64f and in release 0.5.1.
7. 2026-11-03Public advisory published; CVE requested via MITRE CNA-LR.

• Affected repository: earendil-works/absurd
• GitHub Security Advisory: GHSA-6wff-4mpf-gpj8 (private; in triage)