Security: Hardcoded VNC password in GUI template #4

New issue

Closed

opened 2026-03-10 03:45:45 +00:00 by Mark · 1 comment

Mark commented

2026-03-10 03:45:45 +00:00

Owner

Issue

The GUI template uses a fixed VNC password (devforge) documented in code and accessible to anyone.

Location

templates/gui/vnc-start.sh (creates password)
docs/SECURITY.md documents this as a known issue

Risk

Anyone can connect to VNC sessions if port is exposed
No per-session password generation
Documented in SECURITY.md as high-risk

Proposed Solution

Generate per-session VNC passwords on container creation
Store password in session metadata
Expose via API endpoint (already exists: /sessions/{id}/vnc/password)
Disable password auth in favor of tunneled/noVNC-only access

Acceptance Criteria

Generate random password per session
Inject password during container startup
Update API to return generated password
Add option to disable VNC password auth entirely

Priority: High
Type: Security

## Issue The GUI template uses a fixed VNC password (`devforge`) documented in code and accessible to anyone. ## Location - `templates/gui/vnc-start.sh` (creates password) - `docs/SECURITY.md` documents this as a known issue ## Risk - Anyone can connect to VNC sessions if port is exposed - No per-session password generation - Documented in SECURITY.md as high-risk ## Proposed Solution 1. Generate per-session VNC passwords on container creation 2. Store password in session metadata 3. Expose via API endpoint (already exists: `/sessions/{id}/vnc/password`) 4. Disable password auth in favor of tunneled/noVNC-only access ## Acceptance Criteria - [ ] Generate random password per session - [ ] Inject password during container startup - [ ] Update API to return generated password - [ ] Add option to disable VNC password auth entirely **Priority:** High **Type:** Security