From db173af1c9f1246210857ecdb33038c757a4d47c Mon Sep 17 00:00:00 2001
From: Matthias Guillitte <matthias@guillitte.com>
Date: Wed, 19 Aug 2026 15:47:44 +0200
Subject: [PATCH] Only node-red is allowed to run CVE audit

---
 cloud/app.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/cloud/app.py b/cloud/app.py
index b908e91..d1bade8 100644
--- a/cloud/app.py
+++ b/cloud/app.py
@@ -461,6 +461,15 @@ def telemetry():
 @app.route('/api/security/cve-audit', methods=['POST', 'GET'])
 def run_cve_audit():
     """Protected endpoint triggered by Node-RED using REST API + API Key."""
+    # Only node-red is allowed in this endpoint
+    if g.device_id != "node-red":
+        return jsonify({
+            "@odata.error": {
+                "code": "403",
+                "message": "Forbidden: Not allowed to trigger CVE audit"
+            }
+        }), 403
+    
     audit_results = shodan_auditor.audit_server_vulnerabilities()
     
     inserted = cve_audit_results.insert_one({