Agent Identity Security | Security Advisory | SaaS | v1.0.0
Advisory
AppViewX has identified a few medium and low in-house vulnerabilities, which are addressed holistically across the Agent Identity Security product. A high-level overview of these fixes is provided in this document. If a summary of the internal pen test document is required, please reach out to [email protected] or [email protected].
Risk Matrix
| Product Version | Patch Availability |
|---|---|
| Agent Identity Security v1.0.0 - SaaS | Available |
Scope
The scope of penetration testing includes validation of the web application, integration plugins, and the APIs in a SaaS environment.
Vulnerabilities Addressed and Controls Implemented
| Scope | Vulnerabilities Addressed | CVSS v4 | Controls Implemented |
|---|---|---|---|
| Web & API | Injection | 4.3 – 9.3 | Strengthened input validation, secure data handling, output encoding, and content validation controls across applicable application components. |
| Web & API | Identification and Authentication Failures | 3.5 – 9.2 | Strengthened authentication, session lifecycle, token invalidation, password controls, MFA protection, rate limiting, and account recovery controls. |
| Web & API | Broken Access Control | 4.3 – 8.5 | Strengthened RBAC, authorization validation, administrative privilege enforcement, and tenant-level access controls across security-sensitive operations. |
| Web & API | Server-Side Request Forgery (SSRF) | 7.1 – 8.6 | Strengthened outbound request validation, endpoint restrictions, integration configuration controls, and protection of sensitive credentials. |
| Web & API | Insecure Design | 2.7 – 8.2 | Strengthened resource governance, execution controls, API resource limits, pagination controls, and service account governance. |
| Web & API | Cryptographic Failures | 5.3 | Strengthened secrets management and minimized unnecessary exposure of sensitive credentials through application interfaces. |
| Web & API | Security Misconfiguration | 3.7 – 5.3 | Strengthened trusted request handling, CSP, HTTP security headers, CORS, API exposure, transport security, and secure configuration controls. |
Components Upgraded
AppViewX periodically reviews the third-party components used as part of the Agent Identity Security product for vulnerabilities and end-of-life status, and upgrades the components as part of every major release. The components upgraded as part of the Agent Identity Security v1.0.0 - SaaS release are as follows:
| Component | Version |
|---|---|
| Amazon EKS | v1.36 |
| AWS ElastiCache (Redis) | v7.1 |
| Amazon Aurora PostgreSQL | v17.7 |
| Argo CD | v3.5.2 |
| Kargo | v1.11.3 |
| Grafana | v13.2.1 |
| Elasticsearch | v9.2.6 |
| Logstash | 8.19.12 |
| Kibana | v9.2.6 |
| Filebeat | 9.2.8 |
| APM Server | v9.2.6 |
| NGINX Gateway Fabric | v2.7.0 |
| AWS Load Balancer Controller | v3.5.0 |
| KEDA | v2.20.2 |
| Cluster Autoscaler | v1.36.1 |
| EBS CSI Driver | v1.65.0-eksbuild.1 |
| Metrics Server | v0.9.0 |
| External Secrets | v2.10.0 |
Questions or Security Concerns?
Please reach out to the AppViewX Enterprise Information Security at [email protected] for any queries related to product security.
