Remote cluster PATCH response leaked authentication tokens (CVE-2026-7184)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledserver/channels/api4/remote_cluster.go:638

   patchRemoteCluster()

2. 1
   Step 01server/channels/api4/remote_cluster.go:638-642

   An authenticated caller supplies the PATCH body. The handler decodes that body into a RemoteClusterPatch; changing a harmless editable field such as display_name is enough to reach the vulnerable response path.

   var patch model.RemoteClusterPatch
   if jsonErr := json.NewDecoder(r.Body).Decode(&patch); jsonErr != nil {
       c.SetInvalidParamWithErr("remotecluster", jsonErr)
       return
   }
   

3. 2
   Step 02server/channels/api4/remote_cluster.go:623-626

   The endpoint is intentionally reachable to users with manage_secure_connections. That role can manage secure connections but is not equivalent to full system-administrator access to remote-cluster secrets.

   func patchRemoteCluster(c *Context, w http.ResponseWriter, r *http.Request) {
       c.RequirePermissionToManageSecureConnections()
       if c.Err != nil {
           return
       }
   

4. 3
   Step 03server/channels/api4/remote_cluster.go:657-661

   App.PatchRemoteCluster returns the updated stored RemoteCluster object. That object still contains the trust credentials used by the remote-cluster relationship.

   updatedRC, err := c.App.PatchRemoteCluster(c.Params.RemoteId, &patch)
   if err != nil {
       c.Err = err
       return
   }
   

5. 4
   Step 04server/public/model/remote_cluster.go:67-74

   The model exposes both secret fields as JSON fields and provides Sanitize() specifically to blank them before response serialization.

   Token       string `json:"token"`
   RemoteToken string `json:"remote_token"`
   
   func (rc *RemoteCluster) Sanitize() {
       rc.Token = ""
       rc.RemoteToken = ""
   }
   

6. 5
   Step 05server/channels/api4/remote_cluster.go:663-666 (before fix)

   Before PR #36288, the handler added the unsanitized object to the audit result and encoded the same object directly to the client, exposing token and remote_token in the PATCH response.

   auditRec.Success()
   auditRec.AddEventResultState(updatedRC)
   
   if err := json.NewEncoder(w).Encode(updatedRC); err != nil {
       c.Logger.Warn("Error while writing response", mlog.Err(err))
   }
   

7. 6
   Step 06server/channels/api4/remote_cluster.go:660-668 (fix, commit bd8fc92)

   The accepted upstream fix sanitizes the updated object before both audit result capture and JSON encoding. Regression coverage now checks that PATCH responses return empty Token and RemoteToken values.

   updatedRC.Sanitize()
   
   auditRec.Success()
   auditRec.AddEventResultState(updatedRC)
   
   if err := json.NewEncoder(w).Encode(updatedRC); err != nil {
       c.Logger.Warn("Error while writing response", mlog.Err(err))
   }
   

8. Sinkserver/channels/api4/remote_cluster.go:666

   patchRemoteCluster()