{"id":"CVE-2023-1712","kind":"vulnerability","aliases":["CVE-2023-1712","GHSA-w7qg-j435-78qw"],"related":[],"title":"Use of hard-coded, security-relevant constants in deepset-ai/haystack","description":"Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack in version 1.15.0 and prior. A patch is available at commit 5fc84904f198de661d5b933fde756aa922bf09f1.","summary":"The farm-haystack Python package (deepset Haystack) ships security-relevant values hard-coded in the source, which the advisory classes as CWE-547. The sources do not say exactly what the constant controls, but the CVSS score of 9.8 means an unauthenticated remote attacker can likely compromise the affected service.","severity":"critical","cvss":9.8,"epss":0.0085,"exploited":false,"exploited_at":null,"products":[{"name":"farm-haystack","fixed":[],"affected":"<= 1.15.0","ecosystem":"pypi"},{"name":"deepset haystack","fixed":["2023-03-29"],"affected":"< 2023-03-29","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-547","farm-haystack","package","python","self-hosted"],"not_affected_if":["newer-version"],"how_to_check":"- Run `pip show farm-haystack` and confirm the installed version is `1.15.0` or earlier.\n- Check requirements files and lockfiles for `farm-haystack` pinned at `<=1.15.0`.","fix":"- Upgrade `farm-haystack` to the release that includes commit `5fc84904f198de661d5b933fde756aa922bf09f1`; the fixed version number is unknown from the sources.","status":"open","published_at":"2023-03-30T10:15:07+00:00","first_seen_at":"2026-10-27T16:46:06+00:00","triaged_at":"2026-10-27T16:46:11+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T16:46:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `farm-haystack` to the release that includes commit `5fc84904f198de661d5b933fde756aa922bf09f1`; the fixed version number is unknown from the sources.","reach":"unknown","title":"Haystack: hard-coded security constant lets attackers bypass authentication checks","impact":"high","summary":"The farm-haystack Python package (deepset Haystack) ships security-relevant values hard-coded in the source, which the advisory classes as CWE-547. The sources do not say exactly what the constant controls, but the CVSS score of 9.8 means an unauthenticated remote attacker can likely compromise the affected service.","category":"package","nicknames":[],"who_cares":["python","farm-haystack","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unauthorized access to the protected Haystack service functions","analyst_note":"Read GHSA-w7qg-j435-78qw to learn which constant is hard-coded, what it protects, and the first fixed release number.","how_to_check":"- Run `pip show farm-haystack` and confirm the installed version is `1.15.0` or earlier.\n- Check requirements files and lockfiles for `farm-haystack` pinned at `<=1.15.0`.","needs_analyst":true,"not_affected_if":["newer-version"],"who_is_affected":"Teams that run farm-haystack 1.15.0 or earlier in a service that uses the hard-coded value. The sources do not say which feature or configuration uses the constant, so whether a default install is exposed is unknown. Systems on a newer release can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00063,"input_tokens":3343,"output_tokens":591,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-1712':17A,25A '-2023':16A,24A '-547':32B,66B '/haystack':14A,109C '1.15.0':112C '5fc84904f198de661d5b933fde756aa922bf09f1':121C '78qw':22A '9.8':82B 'advisori':62B 'affect':92B 'ai':13A,108C 'attack':87B 'avail':118C 'class':63B 'code':5A,56B,98C 'commit':120C 'compromis':90B 'constant':9A,75B,102C 'control':76B 'cve':15A,23A 'cvss':79B 'cwe':31B,65B 'deepset':12A,29A,47B,107C 'deepset-ai':11A,106C 'exact':72B 'farm':27A,34B,43B 'farm-haystack':26A,33B,42B 'ghsa':19A 'ghsa-w7qg-j435-78qw':18A 'github':104C 'hard':4A,55B,97C 'hard-cod':3A,54B,96C 'haystack':28A,30A,35B,44B,48B 'host':40B 'j435':21A 'like':89B 'mean':83B 'packag':36B,46B 'patch':116C 'prior':114C 'python':37B,45B 'relev':8A,52B,101C 'remot':86B 'repositori':105C 'say':71B 'score':80B 'secur':7A,51B,100C 'security-relev':6A,50B,99C 'self':39B 'self-host':38B 'servic':93B 'ship':49B 'sourc':59B,68B 'unauthent':85B 'use':1A,94C 'valu':53B 'version':111C 'w7qg':20A","nicknames":[],"mitigations":[],"who_affected":"Teams that run farm-haystack 1.15.0 or earlier in a service that uses the hard-coded value. The sources do not say which feature or configuration uses the constant, so whether a default install is exposed is unknown. Systems on a newer release can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2023-03-30T10:15:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-w7qg-j435-78qw","url":"https://github.com/advisories/GHSA-w7qg-j435-78qw","severity":"critical","published_at":"2023-03-30T12:30:15+00:00","modified_at":"2026-10-27T16:46:00+00:00","first_seen_at":"2026-10-27T16:46:06+00:00","fetched_at":"2026-10-27T16:51:11+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-1712","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1712","severity":null,"published_at":"2023-03-30T10:15:07+00:00","modified_at":"2026-06-17T05:28:35+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}