Summary
API keys can be limited to a list of projects. The documentation and the configuration template presented this restriction as enforced, but the MCP tool handlers authenticated the key without consulting its project list.
Per-key project authorization was not enforced across MCP tools
Fixed
High severity
- Advisory ID
- CI-SA-2026-005
- Status
- Fixed
- Severity
- High
- CWE
- CWE-862
- Affected versions
-
- v0.2.0 – v0.6.0 — Code search, call-graph, audit and project-management tools (fixed in v0.7.0)
- v0.2.0 – v0.11.0 — Memory-card and solutions tools (fixed in v0.12.0)
- v0.7.0 – v0.11.0 — Reports, roadmap and card-chat tools (introduced in v0.7.0) (fixed in v0.12.0)
Version identification: Binaries of release v0.2.0 report version 0.1.0 (for example in
--versionoutput and in the MCP server information). Treat a build that reports 0.1.0 as affected; builds reporting 0.1.0 that predate release v0.2.0 were not assessed and must not be assumed unaffected. - Fully remediated in
- v0.12.0
- Recommended upgrade
- v0.12.0 or later
- Published
- Updated
- CVE
- Not assigned
- GitHub advisory
- Not yet published
Impact
A holder of a key restricted to one project — or an AI agent using such a key — could search, run call-graph and audit queries over, and reindex, relocate or delete any project indexed on the server. v0.7.0 enforced the restriction for those tools; the memory and knowledge tools remained unrestricted until v0.12.0, so a restricted key could still read, edit and delete other projects’ memory cards, reports and solutions.
Preconditions
- The server is configured with
[auth] api_keysand at least one key restricted to specific projects (not a wildcard key). - The attacker holds such a key, or controls an AI agent that uses one.
- Installations without project-restricted API keys are not affected.
Affected component
MCP tool dispatch and the project-scoped MCP tools; API-key authentication ([auth] api_keys).
Source modules:
src/mcp/types.rs, src/mcp/mod.rs, src/mcp/tools/
Remediation
Upgrade to CodeIndexer v0.12.0 or later. No alternative workaround is documented.
Fully remediated in: v0.12.0. Code search, call-graph, audit and project-management tools enforce the restriction since v0.7.0; memory-card, solutions, reports, roadmap and card-chat tools since v0.12.0. Recommended upgrade: v0.12.0 or later, which includes the fixes for every advisory currently published in this collection.
v0.7.0 makes authentication return the key’s configuration, adds a project-access check and applies it in the project-scoped tools, including wildcard and reindex-all selectors. v0.12.0 applies the same restriction to the memory and knowledge tools.
Timeline
-
First affected version: v0.2.0 (release-tag commit).
-
Fix for code, graph, audit and project tools committed (
84897f390d7d). -
First fixed version for code, graph, audit and project tools: v0.7.0 (release-tag commit). Reports, roadmap and card-chat tools are added in the same release without the restriction.
-
Fix for memory and knowledge tools committed (
eaf77e23cf79). -
Fully remediated in v0.12.0 (release-tag commit).
-
Advisory published.
Dates come from the project’s git history: fixes by their commit date, versions by the date of the commit their release tag points to — not necessarily the day a build became available for download.
Source references
-
84897f390d7d2026-04-22 Project-access check enforced in code search, call-graph, audit and project-management tools. -
eaf77e23cf792026-09-28 Project restriction applied to the memory and knowledge tools.
CodeIndexer is proprietary software. Commit references identify internal development history and correlate this advisory with our security-review evidence. Their publication does not make the proprietary source code public.
Reporting and contact
Questions about this advisory, or a new vulnerability to report: email [email protected] or open a private advisory on GitHub. See our security policy for the full disclosure process.