Volto chatbot offered a proxy to Danswer endpoints for an AI-backed document search integration. Its generic route accepted requests without binding them to a caller with Danswer permissions. Consequently, a remote client with access to the Volto server could reach downstream Danswer functions with the backend credential, turning the chatbot into a…
Inspect the ClaimsCase · DiggingBeagle record
Volto chatbot forwarded unauthenticated requests through Danswer service credentials
GHSA-w9x9-j56r-h98r describes a Volto chatbot API route that accepted unauthenticated requests and forwarded them to Danswer using the server-configured credential, until version 2.0.4.
Scope
Requires the affected integration and a reachable router; downstream access depends on what the Danswer service credential permits, and no real-world abuse is established.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The advisory describes a reachable Volto proxy forwarding requests to Danswer with backend credentials instead of end-user authorization, with a fix in 2.0.4. The downstream effect is bounded by the credential permissions; observed field theft is not supplied. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-VOLTO-DANSWER-DEPUTY-1 · GitHub advisory GHSA-w9x9-j56r-h98r, Volto Danswer proxy
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsRequires the affected integration and a reachable router; downstream access depends on what the Danswer service credential permits, and no real-world abuse is established.
Limits and uncertaintyFull account
Volto chatbot offered a proxy to Danswer endpoints for an AI-backed document search integration. Its generic route accepted requests without binding them to a caller with Danswer permissions. Consequently, a remote client with access to the Volto server could reach downstream Danswer functions with the backend credential, turning the chatbot into a privileged proxy instead of an authorization boundary.
A backend chatbot proxy cannot confer downstream user rights from the mere presence of a service credential. Each requested Danswer operation needs an independently checked user principal and permitted resource scope, otherwise a caller with access to the proxy inherits the server credential authority. This is distinct from an LLM choosing to ignore instructions.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-VOLTO-DANSWER-DEPUTY-1GHSA-w9x9-j56r-h98r describes a Volto chatbot API route that accepted unauthenticated requests and forwarded them to Danswer using the server-configured credential, until version 2.0.4.supported
Basis: reported finding
- supportsGitHub advisory GHSA-w9x9-j56r-h98r, Volto Danswer proxyprimary disclosure
GHSA-w9x9-j56r-h98r, Description, Impact and affected package versions
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Upgrade to version 2.0.4, authorize each proxied operation at the application boundary and restrict the backend credential to minimum Danswer privileges.
Unknowns and contradictions
- Requires the affected integration and a reachable router; downstream access depends on what the Danswer service credential permits, and no real-world abuse is established.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211