The following advisories were identified and remediated prior to their respective releases. Documented here for transparency.

⚠️ Reference architecture notice: CAGE is a reference architecture and is not deployed to production. These advisories are tracked for completeness and to ensure the codebase accurately represents the security posture claimed in associated research publications.

Please do not report security vulnerabilities through public GitHub issues.

To report a security vulnerability, please use the GitHub Security Advisory "Report a Vulnerability" feature. Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any proof-of-concept code (if applicable)
• Your suggested fix (if you have one)

You should receive a response within 5 business days. If you do not receive a response, please follow up to ensure your report was received.

We follow a coordinated disclosure model:

1. You report the vulnerability privately.
2. We confirm receipt and begin investigation within 5 business days.
3. We develop and test a fix.
4. We release the fix and publish a security advisory.
5. You may publicly disclose the vulnerability after the fix is released, or after 90 days from the initial report — whichever comes first.

An advisory's fix lands from GitHub's temporary private fork, where GitHub Actions does not run. Ruleset 25966171 requires eight status checks on main and has no bypass actor, so it blocks that merge. Do not add a bypass actor. Ruleset 26377312, which blocks force pushes to main and its deletion, stays enabled throughout: the merge is a fast-forward. For that one merge:

1. Run the test suite on the frozen fix commit and record the result in the advisory's release record, since the private fork gets no CI.
2. Disable the checks ruleset: gh api -X PUT repos/google/cybernetic-agent-governance-engine/rulesets/25966171 -f enforcement=disabled
3. Merge the advisory's pull request, then re-enable the ruleset at once: gh api -X PUT repos/google/cybernetic-agent-governance-engine/rulesets/25966171 -f enforcement=active
4. Record both ruleset-history entries (gh api repos/google/cybernetic-agent-governance-engine/rulesets/25966171/history) and the merge commit in the advisory's release record.
5. Watch the first CI run on main for the landed commit, and fix forward if it fails.

The following are in scope for security reports:

• Remote code execution in the governance gateway or compliance bridge
• Authentication/authorisation bypass in the governance pipeline
• Governance tier bypass (violations of the NoDirectBind invariant)
• Injection vulnerabilities (prompt injection, SQL injection, etc.)
• Cryptographic weaknesses in the Cloud KMS signing, kid-resolved trust anchors, development-only software signers (Ed25519 / HMAC-SHA256), routing seals, or the SHA-256 hash-chain implementation
• Control Barrier Function (CBF) race conditions or invariant violations
• Secrets or credentials exposed in the repository

The following are out of scope:

• Vulnerabilities in third-party dependencies (report these upstream)
• Denial-of-service attacks requiring physical access
• Social engineering attacks
• Issues in documentation only

CAGE is a domain-agnostic governance substrate designed for regulated environments generally; the shipped example domains (finance and healthcare) and the selectable jurisdictional postures (US_FED, EU_ECB, APAC_MAS, LOCAL) determine which regulatory controls are in scope for a given deployment. Key security controls are documented in:

• docs/security/SECURITY_STATUS.md — full security posture, NIST RMF status, and all open POA&M items
• docs/operations/KEY_ROTATION.md — cryptographic key lifecycle and rotation runbooks (SC-12 / IA-5)
• docs/architecture/GATEWAY_ARCHITECTURE.md
• deployment/k8s/K8S_SECURITY_HARDENING.md
• COMPLIANCE.md

Note: CAGE v3.x is a reference architecture. Regulated-environment deployers must conduct their own risk assessment before production use. See docs/security/SECURITY_STATUS.md for the complete posture breakdown and pre-deployment checklist.

Replay-attack closure: KMS-signed reconciliation payloads embed a signed_at Unix timestamp. The verifier (KMSGovernanceSigner.verify() in kms_signer.py) rejects any payload where now - signed_at > 300 s (MAX_KMS_PAYLOAD_AGE_SECONDS).

Strict Replication & Fence Epoch Hardening: In production (CAGE_ENV=prod), ControlBarrierFunction asserts synchronous replica replication (CAGE_STRICT_REPLICATION=true). If replica synchronization fails during WAIT, the local balance debit is automatically rolled back (rollback_state(cost)) and fails closed. Monotonic safety:fence_epoch counters prevent stale-replica balance replays.

Audit Durability & Citation Guarantee: validate_evidence_stream_preconditions() is posture-based: under an enforcing posture (anything but dev/test/ci; an unset CAGE_ENV is production) it halts startup if EVIDENCE_STREAM_ENABLED=false, or if EVIDENCE_CHAIN_BLOCKING=false without an explicit CAGE_ALLOW_NONBLOCKING_PROD=true. The gateway lifespan also starts the sink via start_evidence_sink() and fails closed, so no routing seal or ConsequenceGateway EXECUTE verdict is issued without durable evidence commitment to the tamper-evident log. In the compliance bridge, EvidenceCustodian signs batches with EVIDENCE_KMS_KEY and writes them via put_if_absent() to WORM cold storage, while CustodyVerifier (evidence_verifier.py) re-verifies the archive on EVIDENCE_VERIFY_INTERVAL_S against kid-resolved trust anchors and gates OSCAL assessment citations (OSCAL_REQUIRE_VERIFIED_CUSTODY=true).

Header-spoofing closure: Caller identity is never read from application-layer data. X-Agent-ID headers, body-supplied agent_id fields, and the X-CAGE-Routing-Seal header are not accepted as authentication. The sole source of truth is the l5d-client-id header, which the Linkerd inbound proxy sets from the verified mTLS peer certificate (or strips when there is none). The gateway accepts exactly one such header matching CAGE_TRUSTED_CLIENT_IDENTITIES, in every environment; anything else fails closed with 403 rather than falling back to an anonymous principal. The mesh AuthorizationPolicy independently admits only the advisor's service account (POAM-2026-080).

Ambient-credential closure: Outbound API credentials are no longer held by adapters. They are requested per dispatch from a CredentialBrokerAdapter, keyed on the calling agent's SVID and the tool name, injected as request headers at dispatch time, and held only in local scope. Credential values never appear in ActuationReceipt, findings, or HTTP response bodies — asserted by test_credential_headers_not_in_audit_record.

Masking is prefix-preserving, not total. Log masking applies value[:8] + "****". For an Authorization: Bearer <token> header only the scheme survives, but a broker that returns a bare-token header will leak the first 8 characters of the secret into logs. Brokers should return scheme-prefixed header values.

The following patterns are strictly forbidden in production code and will be rejected in review:

• PROHIBITED: secret = os.environ.get("API_KEY", "default-secret")
• REQUIRED: Fail-closed validation asserting os.environ["API_KEY"] exists and meets minimum entropy length (>= 32 chars).

• PROHIBITED: subprocess.run(command, shell=True)
• REQUIRED: subprocess.run(shlex.split(command)) with direct argument lists.

• PROHIBITED: requests.get(url, verify=False)
• REQUIRED: Explicit TLS certificate verification (verify=True).

• PROHIBITED: pickle.loads(data) or unconstrained yaml.load(data)
• REQUIRED: json.loads(data) or yaml.safe_load(data).

All prohibited patterns are enforced via static grep checks, pre-commit hooks, CI security jobs, and targeted unit regression suites in tests/test_*_security.py.

The CAGE maintainers thank the following researchers for reporting security and governance boundary observations with reproducible test cases:

• Daniel Fairbanks (@danofairanks) — Boundary analyses and hardening reports across CAGE's runtime governance, provenance, and offline evaluation planes (#379, #405, #406, #463, #464, #465, #472, #473, #511, #512, #513, #514, #516), including trajectory NARROW vs. ALLOW metric separation, multi-turn shadow-state tier parity, RefusalReceipt proof_hash verification and DPO chosen-argument sanitization, offline drawback-detector, SKILL.md static-linter, rollout-runner symbol/HTTP bounds, fail-closed Stage 2 certification gating (--stage0-only), positive-lift and drawback enforcement in run_certification_gate(), STPAValidator action normalization / approval-token validation / core-rule preservation, actuator_02 signed-receipt enforcement, FTRA NaN-confidence guards, FTRA registry expires_at enforcement, retry-safe evidence stream appends and chain-truncation detection, stage- and evidence-bound .cer skill-certification receipts (cage.skill.cer.v2), full-order routing-verdict reuse and multi-step trade plan previews, MCP send-phase retry boundaries and ExecutionLedger trade idempotency, and explicit end-user principal assertion boundaries.
• @moiznationzz — Reported the compliance-bridge dual-control quorum bypass via unverified x-cage-source-principal headers, CAGE_ENV default authentication bypass in deployment/k8s/compliance-bridge.yaml, and uninvoked verify_webauthn_challenge() in DeferQueue.approve() (GHSA-529c-23c8-3m42).
• @Zorta-Zenith — Independently reported the x-cage-source-principal multi-party quorum forgery and OIDC fallback gap in src/compliance_bridge/auth.py (GHSA-qrg7-27x4-mq39).
• @m0ssser — Reported the docker-compose.yml entrypoint override exposing mcp_tool_server.py's POST /tools/execute (trigger_safety_intervention) without WorkloadIdentityMiddleware (GHSA-4x3x-w2m3-8mfh).
• @ArksherX — Reported Control Barrier Function (CBF) ground-truth balance verification and atomic reservation boundary findings (GHSA-cmwm-295c-gjf6, GHSA-w7g7-wjj9-6j97, GHSA-w7f4-8grh-2xv8).
• @uwezkhan — Reported the inference proxy multi-role / streaming governance bypass (GHSA-hfqj-24cj-693g) and /governance/validate-action ingress authentication boundary (GHSA-v3h4-8458-5ww3).
• Dominik Blain (@dom-omg), Ironproof — Reported, with step-by-step reproductions, that a normative-provider determination revoked during human review was never re-checked after approval (the EU_ECB fria tier did not run under POST_HITL), that execute_trade_bounded and case or whitespace variants of BTC bypassed trade_governance.rego, and that the FRIA payload named no caller and the provider_01 request relied on self-asserted mandate facts (GHSA-f6xq-23f7-9grm, POAM-2026-113). Thank you for a careful, clearly reasoned report.