Description
The database table that stores agent registration API keys persists the full plaintext key value as issued. A database backup, a SQL injection vulnerability, or direct database access exposes all agent API keys. Compromised keys allow unauthorized agents to ingest traces or access observability data.
Steps to Reproduce
- Register an agent and obtain an API key.
- Query the database directly (or exploit any SQL injection):
SELECT * FROM api_keys;
- Observe the full API key value is stored as plaintext.
Root Cause
API keys are stored without hashing, making the database the sole source of truth for the key value itself.
Impact
A database breach exposes all agent credentials simultaneously. Leaked keys allow unauthorized trace ingestion and data pollution.
Proposed Fix
Store only a SHA-256 hash of the key, return the plaintext once at issuance only:
import { createHash, randomBytes } from "crypto";
const rawKey = randomBytes(32).toString("hex");
const keyHash = createHash("sha256").update(rawKey).digest("hex");
await db.apiKeys.insert({ keyHash, agentId, createdAt: new Date() });
// return rawKey to agent once; never stored againOn verification, hash the incoming key and compare to stored hash.
Description
The database table that stores agent registration API keys persists the full plaintext key value as issued. A database backup, a SQL injection vulnerability, or direct database access exposes all agent API keys. Compromised keys allow unauthorized agents to ingest traces or access observability data.
Steps to Reproduce
SELECT * FROM api_keys;Root Cause
API keys are stored without hashing, making the database the sole source of truth for the key value itself.
Impact
A database breach exposes all agent credentials simultaneously. Leaked keys allow unauthorized trace ingestion and data pollution.
Proposed Fix
Store only a SHA-256 hash of the key, return the plaintext once at issuance only:
On verification, hash the incoming key and compare to stored hash.