BUG-HUNT: [security] Default server host binds to all interfaces — change default to `localhost` #2995

New issue

Open

opened 2026-04-05 03:21:52 +00:00 by freemo · 1 comment

freemo commented

2026-04-05 03:21:52 +00:00

Owner

Metadata

Branch: fix/m3-server-host-default-localhost
Commit Message: fix(config): change default server_host from 0.0.0.0 to localhost
Milestone: v3.3.0
Parent Epic: #362

Background

The server_host setting in Settings (located at src/cleveragents/config/settings.py, line 103) defaults to "0.0.0.0", which causes the application to listen on all network interfaces. While convenient for development, this is a security risk in production environments without proper firewalling — the application could be inadvertently exposed to the public internet.

The current code uses a # nosec B104 suppression comment, acknowledging the risk but not mitigating it at the default level.

Evidence

server_host: str = Field(
    default="0.0.0.0",  # nosec B104
    validation_alias=AliasChoices("CLEVERAGENTS_SERVER_HOST"),
)

Subtasks

Change default="0.0.0.0" to default="localhost" in Settings.server_host field (src/cleveragents/config/settings.py, line 103)
Remove the # nosec B104 suppression comment (no longer needed with a safe default)
Update any documentation or configuration examples that reference 0.0.0.0 as the default host
Verify that existing tests still pass and update any tests that assert the old default value
Add or update a test asserting that the default server_host is "localhost"

Definition of Done

Settings.server_host defaults to "localhost" instead of "0.0.0.0"
The # nosec B104 suppression comment is removed
All existing tests pass with the new default
A test explicitly asserts the new default value of "localhost"
Users can still override the host to "0.0.0.0" via the CLEVERAGENTS_SERVER_HOST environment variable
All nox stages pass
Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/m3-server-host-default-localhost` - **Commit Message**: `fix(config): change default server_host from 0.0.0.0 to localhost` - **Milestone**: v3.3.0 - **Parent Epic**: #362 ## Background The `server_host` setting in `Settings` (located at `src/cleveragents/config/settings.py`, line 103) defaults to `"0.0.0.0"`, which causes the application to listen on **all** network interfaces. While convenient for development, this is a security risk in production environments without proper firewalling — the application could be inadvertently exposed to the public internet. The current code uses a `# nosec B104` suppression comment, acknowledging the risk but not mitigating it at the default level. ## Evidence ```python server_host: str = Field( default="0.0.0.0", # nosec B104 validation_alias=AliasChoices("CLEVERAGENTS_SERVER_HOST"), ) ``` ## Subtasks - [ ] Change `default="0.0.0.0"` to `default="localhost"` in `Settings.server_host` field (`src/cleveragents/config/settings.py`, line 103) - [ ] Remove the `# nosec B104` suppression comment (no longer needed with a safe default) - [ ] Update any documentation or configuration examples that reference `0.0.0.0` as the default host - [ ] Verify that existing tests still pass and update any tests that assert the old default value - [ ] Add or update a test asserting that the default `server_host` is `"localhost"` ## Definition of Done - [ ] `Settings.server_host` defaults to `"localhost"` instead of `"0.0.0.0"` - [ ] The `# nosec B104` suppression comment is removed - [ ] All existing tests pass with the new default - [ ] A test explicitly asserts the new default value of `"localhost"` - [ ] Users can still override the host to `"0.0.0.0"` via the `CLEVERAGENTS_SERVER_HOST` environment variable - [ ] All nox stages pass - [ ] Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: ca-new-issue-creator

freemo added this to the v3.3.0 milestone

2026-04-05 03:22:44 +00:00

freemo referenced this issue

2026-04-05 03:24:31 +00:00

[CA-AUTO] System Watchdog — Session Tracker #2877

freemo added a new dependency

2026-04-05 03:25:18 +00:00

#362 Epic: Security & Safety Hardening

freemo commented

2026-04-05 03:43:12 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: Confirmed
MoSCoW: Should Have

Valid finding verified during batch triage.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **Priority**: Confirmed - **MoSCoW**: Should Have Valid finding verified during batch triage. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo referenced this issue

2026-04-05 03:44:41 +00:00

[CA-AUTO] System Watchdog — Session Tracker #2877

freemo referenced this issue

2026-04-05 04:06:08 +00:00

BUG-HUNT: [security] Potential ReDoS vulnerability in 'tool list' command #3028

freemo referenced this issue

2026-04-05 06:15:22 +00:00

[CA-AUTO] UAT Pool Supervisor — v3.2.0–v3.7.0 — Session Tracker #3094