Splunk, Loom, ClearPass, SonicWall: Four Control Planes That Ship Without Auth

Splunk’s cluster-coordination sidecar. Loom’s agent control plane. ClearPass’s network admission layer. SonicWall’s remote-access edge. Four vendors, four architectures, one missing check: in every case the component that arbitrates trust shipped without asking who was asking. The class has a name. Missing authentication for a critical function (CWE-306) covers products that perform no authentication for functionality that requires a provable user identity or consumes significant resources. MITRE’s notes on how the weakness enters code describe the habit precisely: developers secure the primary channel, then leave open a secondary channel they assume is private.

Source: Forkast