FlyteAdmin (built-in OAuth authorization server, default client secret hashes): MULTI-TENANT ISOLATION: Turning on

Impact

MULTI-TENANT ISOLATION: Turning on Flyte's built-in authorization server without replacing the shipped default client ID hashes leaves publicly known credentials in place. Anyone who reads the docs authenticates as FlytePropeller and reaches the FlyteAdmin control plane, which means enumerating and manipulating every tenant's workflow executions on a deployment the operator believes is authenticated.

Who can reach it

Any internet or network host that can reach FlyteAdmin, using the documented default client secrets. No prior access needed.

What to do

Rotate the client ID hashes to values you generated, then upgrade FlyteAdmin to 1.1.44 or later and restart. Verify the running config does not still carry the shipped defaults after the upgrade - this is a configuration flaw that a version bump alone will not correct.

References