cyberark/secretless-broker v2.0.0

on GitHub

[2.0.0] - 2026-07-15

Added

• TCP connectors (pg, mysql, mssql) now support a database credential that
  pins the backend session to the operator-configured database.
  See Security hardening. CNJR-13756.
• A [SECURITY] warning is emitted at startup when a TCP service binds to a
  non-loopback address. See Security hardening.

Changed

• Breaking: HTTP connector requests that match no configured service are now
  rejected with HTTP 403. Previously, requests whose URL did not match any
  authenticateURLsMatching pattern were forwarded as an unauthenticated open
  proxy to the client-supplied destination, allowing network-adjacent attackers
  to pivot through the broker into backend networks (SSRF). Only requests that
  match a configured subservice are now forwarded. CNJR-13754.
• Breaking: HTTP connectors now enforce TLS by default (forceSSL: true).
  The generic HTTP connector and the basic_auth and conjur connectors
  built on it previously defaulted forceSSL to false, which allowed the
  injected backend credential (e.g. the Authorization header) to be sent to
  the upstream over plaintext http. Deployments that intentionally rely on a plaintext http
  upstream must now explicitly set forceSSL: false in the connector config
  to keep working; otherwise the upstream must support TLS (recommended). When
  forceSSL: false is set, a [SECURITY] startup warning is emitted so that
  intentional cleartext credential transmission is visible in logs.
  See the field reference in
  internal/plugin/connectors/http/generic/README.md.
• forceSSL can now also be set on HTTP handlers in v1 file configs and
  Kubernetes CRD resources, so those deployments have
  the same forceSSL: false opt-out as v2 file configs. Previously the v1/CRD
  path could not express forceSSL at all.
  Operators must re-apply the updated definition kubectl apply -f resource-definitions/secretless-resource-definition.yaml CNJR-13759.