Issues

• [Security][Medium] Unauthenticated JAR-store uploads have no quota or lifecycle cleanup

  k: bugm: security
  gearpump/gearpump#2407 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][Medium] Guest users can mutate JAR storage through a GET multipart upload

  k: bugm: security
  gearpump/gearpump#2404 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][Medium] Cookie-authenticated management routes have no application-enforced CSRF defense

  k: bugm: security
  gearpump/gearpump#2403 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][Medium] Daemon scripts use predictable PID and log paths in shared /tmp

  k: bugm: security
  gearpump/gearpump#2400 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][Medium] OAuth callbacks are not bound to the initiating browser session

  k: bugm: security
  gearpump/gearpump#2398 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][Medium] Upload routes leak temporary files and permit persistent disk exhaustion

  k: bugm: security
  gearpump/gearpump#2397 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][Medium] Beam GroupByKey retains unbounded-source data until the terminal watermark

  k: bugm: security
  gearpump/gearpump#2396 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][High] Unauthenticated dynamic-DAG replacement can deploy attacker code into another application

  k: bugm: security
  gearpump/gearpump#2394 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][High] Application JARs are downloaded over cleartext HTTP without integrity verification

  k: bugm: security
  gearpump/gearpump#2393 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][High] Multipart text fields can allocate up to two gigabytes in the UI JVM

  k: bugm: security
  gearpump/gearpump#2392 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][High] Unauthenticated task transport permits session enrollment and stream-record injection

  k: bugm: security
  gearpump/gearpump#2390 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][High] Packaged DistributedShell accepts commands from any cluster client

  k: bugm: security
  gearpump/gearpump#2388 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][High] Application key-value data lacks an application ownership boundary

  k: bugm: security
  gearpump/gearpump#2387 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][High] The unauthenticated JAR download endpoint permits storage-root escape

  k: bugm: security
  gearpump/gearpump#2386 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][High] Reachable actor clients can terminate, restart, or hijack applications

  k: bugm: security
  gearpump/gearpump#2385 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][High] Authenticated dashboard traffic and role-bearing cookies are supported over cleartext HTTP

  k: bugm: security
  gearpump/gearpump#2384 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][Critical] Unauthenticated Pekko clients can submit and execute arbitrary application JARs

  k: bugm: security
  gearpump/gearpump#2382 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][Critical] Packaged UI defaults permit unauthenticated uploaded-JAR code execution

  k: bugm: security
  gearpump/gearpump#2381 · Filter by author manuzhang opened on Oct 3, 2026

• [Security][Critical] Workers accept forged LaunchExecutor messages that spawn attacker-controlled JVMs

  k: bugm: security
  gearpump/gearpump#2380 · Filter by author manuzhang opened on Oct 3, 2026

• EPIC: Build a durable runtime for stateful AI agents and continuous AI workflows

  0 - backlogk: design proposalk: featurem: corem: use case
  gearpump/gearpump#2361 · Filter by author manuzhang opened on Aug 12, 2026

• Fix CVE-2019-20444

  gearpump/gearpump#2324 · Filter by author manuzhang opened on May 27, 2026
  6