DeepTutor: any-origin CORS opens the admin API to websites

No upstream patch is available yet. Anyone running DeepTutor, even only on their own machine, should apply one of these mitigations until an official fix is released.

1. Turn authentication on (AUTH_ENABLED=true). In that mode the any-origin regex is not used and cross-origin requests are limited to the frontend origins plus any you list in CORS_ORIGIN or CORS_ORIGINS.
2. If you keep authentication off, apply the small patch from our report: in _build_cors_settings in deeptutor/api/main.py, stop setting allow_origin_regex to https?://.* and limit CORS to the configured frontend origins in every mode. Add remote Docker or LAN frontends through CORS_ORIGINS instead.
3. Do not browse untrusted sites in the same browser while a no-auth DeepTutor backend is running, and stop the backend when you are not using it.
4. Review the MCP server registry (Settings, MCP) for stdio servers you did not add, and rotate the provider API keys configured in DeepTutor if you suspect it was reached cross-origin.
5. For the web_fetch tool, patch deeptutor/tools/web_fetch.py to resolve the host once, check every address, and connect to that checked address, or block private and link-local ranges at the network level for the DeepTutor process.

Any DeepTutor backend running with authentication off is exposed to every web page its user opens, as far as the browser lets public pages reach the backend's address. A backend reachable over a LAN or a remote Docker host, which is the setup the permissive default exists for, is the easiest case. Because require_admin treats every caller as admin when authentication is off, the page reaches the same admin routes the DeepTutor frontend uses and can read the answers.

Based on code review, that includes POST /api/settings/mcp/test, which connects to the MCP server described in the request body; for a stdio server that means running its command on the host as the DeepTutor user. The rest of the admin settings surface, including the MCP registry and model provider settings, is reachable the same way. The web_fetch rebinding gap lets content that steers the agent make the server fetch internal or metadata addresses. A working exploit is withheld.

_build_cors_settings returns the regex https?://.* whenever authentication is off, and the app installs CORSMiddleware with that regex, allow_credentials=True, and every method and header allowed. CORSMiddleware echoes back any matching Origin, so every website gets a credentialed allow. The admin dependency then accepts every request in no-auth mode:

• Any-origin regex when auth is off: deeptutor/api/main.py#L95-L99
• CORSMiddleware with credentials and all methods and headers: deeptutor/api/main.py#L485-L492
• require_admin treats every caller as admin when auth is off: deeptutor/api/routers/auth.py#L622-L643
• MCP settings router gated only by require_admin: deeptutor/api/routers/mcp_settings.py#L34
• MCP test route probes the server from the request body: deeptutor/api/routers/mcp_settings.py#L121-L133
• Stdio transport starts the configured command: deeptutor/services/mcp/manager.py#L779-L789
• web_fetch checks the host with its own DNS lookup, then the client resolves again: deeptutor/tools/web_fetch.py#L178-L210 and web_fetch.py#L117-L134

1. 2026-07-17Vulnerability reported privately via GitHub Security Advisory (GHSA-22fg-5qwc-4cpg).
2. 2026-08-18First follow-up comment posted on the advisory (32 days in triage).
3. 2026-09-17Second follow-up comment posted on the advisory (62 days in triage).
4. 2026-10-20Coordinated-disclosure notice posted on the advisory after the 90-day window passed, setting a deadline of 2026-11-03. The notice acknowledged the related hardening (catalog API key redaction, removal of the old tool execute endpoint).
5. 2026-11-03Coordinated-disclosure deadline expired with no response from the maintainer; sink verified still present at HEAD f7aed07 and in release v1.7.1.
6. 2026-11-03Public advisory published; CVE requested via MITRE CNA-LR.

• Affected repository: HKUDS/DeepTutor
• GitHub Security Advisory: GHSA-22fg-5qwc-4cpg (private; in triage)