phoenix-oss/llama-stack-mirror
0
0
Fork 1
mirror of https://github.com/meta-llama/llama-stack.git synced 2025-12-21 10:02:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
llama-stack-mirror/src/llama_stack/core/routers
History
Derek Higgins 8940be23c4
fix: RBAC bypass vulnerabilities in model access (#4270) 
Closes security gaps where RBAC checks could be bypassed:

o Inference router: Added RBAC enforcement in the fallback
  path to ensure access control is applied consistently.

o Model listing: Dynamic models fetched via provider_data were returned
  without RBAC checks. Added filtering to ensure users only see models
  they have permission to access.

Both fixes create temporary ModelWithOwner objects for RBAC validation,
maintaining security through consistent access control enforcement.

Closes: #4269

Signed-off-by: Derek Higgins <derekh@redhat.com>
2025-12-03 08:42:22 -05:00
..
__init__.py feat!: Architect Llama Stack Telemetry Around Automatic Open Telemetry Instrumentation (#4127) 2025-12-01 10:33:18 -08:00
datasets.py fix: rename llama_stack_api dir (#4155) 2025-11-13 15:04:36 -08:00
eval_scoring.py fix: rename llama_stack_api dir (#4155) 2025-11-13 15:04:36 -08:00
inference.py fix: RBAC bypass vulnerabilities in model access (#4270) 2025-12-03 08:42:22 -05:00
safety.py feat!: Architect Llama Stack Telemetry Around Automatic Open Telemetry Instrumentation (#4127) 2025-12-01 10:33:18 -08:00
tool_runtime.py fix: MCP authorization parameter implementation (#4052) 2025-11-14 08:54:42 -08:00
vector_io.py fix: rename llama_stack_api dir (#4155) 2025-11-13 15:04:36 -08:00