Hey guys! Hope you are all well, I have a security concern. I reported a vulnerability in

metaflow-service

to Huntr back on March 24, and just got told by their admin that they tried reaching the maintainers but didn't get through, so they suggested I follow up here directly. It's a pre-auth issue, CVSS 10.0 with a chain I confirmed end-to-end today during re-validation. Full details, PoC, and code references are in the Huntr report: https://huntr.com/bounties/0a0fceee-b352-4295-894a-2c48003c6f6c Happy to share more privately. Who's the right person to loop in?

report isnt public. please loop in @thankful-ambulance-42457 @ancient-application-36103 @dry-beach-38304 @rhythmic-controller-77489 and myself

Hi @hundreds-rainbow-67050, for security reasons, what’s your usual procedure? I don’t seem to see any option on Huntr to add people, and obviously I don’t want to share details of a CVSS 10.0 vulnerability in a public Slack channel. Should I send each of you a private message? Should I create a small group?

hey — I also can’t see the report. I don’t know who they mean by “maintainers”. I can check with our security folks. We don’t use the service internally (there is a different version of it). Who did they try to reach out to?

Hi all, @hundreds-rainbow-67050 @dry-beach-38304 @square-wire-39606 @thankful-ambulance-42457 @rhythmic-controller-77489 the guys from Huntr contacted you on the email conductor@netflix.com, In any case, I’ve been told that I can share this with the people you deem most necessary (I assume the same ones that @hundreds-rainbow-67050 tagged in the first message), so I can send you the full report with everything I’ve found as soon as the CVE is created. After that, I’ll be able to speak directly with Huntr about the bounty, so you won’t have to worry about it. How should we proceed? Can you set up a small group? (Sorry, but I’m not very familiar with Slack)

conductor at netflix ?!?! Ya, that would definitely not go to the right folks. You can send it to us yes. You can create a dm with us.

@dry-beach-38304 ahahah alrght, I will let them know to update their contacts... I sent to all of u the detail of the Vuln 🙂