René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Hardening] F-12: Absence of Per-Account or Per-User Source CIDR Allowlist.","articleBody":"### The required feature described as a wish\n\n**Description:** CloudStack does not provide a built-in mechanism to restrict per-account or per-user access to a defined set of source IP addresses or CIDR ranges. Any IP address that can reach the management plane can attempt to authenticate as any account.\n\n**Affected Components:** Management UI / API\n\n**Impact:** Without source IP allowlisting, a stolen API key or compromised credential set can be used from any network location globally. There is no network-level control to limit the blast radius of a credential compromise. High-privilege service accounts are particularly at risk, as they can be accessed from unexpected locations without raising any flags.\n\n**Steps to Reproduce:**\n- This finding is not directly reproducible since it reflects the absence of a control.\n\n**Recommended Remediation:** Implement a per-account or per-user source CIDR allowlist field in the data model. Requests originating from IPs outside the defined allowlist should be rejected and logged as a security event.","author":{"url":"https://github.com/davift","@type":"Person","name":"davift"},"datePublished":"2026-06-04T01:02:57.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/13340/cloudstack/issues/13340"}