Four Vendors Shipped the Same Missing Check. Your Coordination Layer Shipped It Too.

Four vendors. Four architectures. One missing check. Splunk Enterprise. Loom for AWS. HPE ClearPass. SonicWall SMA 1000. Each shipped a component whose only job is to arbitrate trust — and each shipped it without asking who was asking. The class has a name: CWE-306, missing authentication for a critical function. MITRE's Top 25 has carried it since 2023. The mechanism never varies. Developers harden the primary channel, then leave a secondary channel open because they assume the network around it is private. The crypto industry reads enterprise CVEs as somebody else's problem. That read is a latency error. Every chain, every rollup, every bridge runs the identical topology: a public surface for users, and a coordination surface — RPC endpoints, sidecar APIs, relayer admission, keeper bots — that the team treats as private. The private assumption is the bug. Consensus is not a feature; it is the only truth, and it does not extend to an interface that never asked for a credential. Start with the four disclosures as data. Splunk: CVE-2026-76268, CVSS 9.8. The Patroni REST API on a search head cluster member — the coordination interface behind the PostgreSQL sidecar — requires no authentication for critical configuration operations. Any unauthenticated user with network access runs attacker-controlled operating-system commands. Found internally, credited to Gabriel Nitu, no exploitation reported. Loom for AWS: CVE-2026-103956, CVSS v4.0 10.0. In versions before 1.6.1 deployed with no identity provider configured, the authentication dependency returned a fixed t-admin identity for every request — including requests carrying no Authorization header at all. That identity granted full administrative authority over the agent control plane: registering tool servers, reading stored integration credentials, rewriting the IAM role policies attached to managed agent roles. ClearPass: HPE advisory HPESBNW05158 rev.1, 28 vulnerabilities, ten critical, eleven high, seven medium. Two criticals carry the shape: CVE-2026-76750, CVSS 9.8, unauthenticated deserialization to remote code execution through the web interface; CVE-2026-76752, unauthenticated authentication bypass granting admin access to the management and API interfaces. Fixes shipped in 6.11.16 and 6.14.1. SonicWall SMA 1000: CVE-2026-102255, 10.0, a pre-authentication SSRF through an unintended access path in the Work Place interface. Confused deputy — CWE-918 and CWE-441. No credential required. Workaround: none. Third SMA 1000 disclosure opening the same way. MITRE's notes describe how the weakness enters code, and the description is a habit, not an accident: developers secure the primary channel, then leave open a secondary channel they assume is private. In these four disclosures the secondary channel is a cluster API, an agent control plane, a network access controller, and a VPN appliance's proxy layer. Four nouns. One grammar. In all four, the component that arbitrates trust never verified the trust. That sentence is the entire class. Now map it onto the chain. Ethereum's post-merge architecture does not let a validator talk to the network directly. A validator client talks to a beacon node. The beacon node talks to an execution client. The whole stack is stitched together with HTTP and gRPC interfaces designed to be reachable only by the local process. The consensus client's HTTP API — Lighthouse, Prysm, Teku — exposes proposer duties, validator status. Default bind: localhost. Default auth: none. That is Patroni's REST API wearing different clothes. When I reverse-engineered the Casper FFG finality conditions in 2017 and built a Python simulator to test slashing edge cases against theoretical attacks, the interfaces I probed were exactly these secondary channels — the ones outside audit scope, the ones nobody filed a ticket for. Two of my findings reached the spec. The third was closed as out of scope. It was a binding configuration, not a code bug. Same assumption: the network around it is private. The post-merge engine API is the counter-example that proves the rule. When execution and consensus clients were split apart, the interface between them — the engine API — was authenticated with a JWT secret. That check exists because the secondary channel between two processes was finally recognized as a trust boundary. Every other sidecar in the stack did not get the same treatment. The pattern is not that crypto cannot authenticate secondary channels. The pattern is that it authenticates the ones it remembers. Loom is the cleanest illustration of a pattern crypto ships. With no IdP configured, the auth dependency returns t-admin for everyone. The affected population is not an edge case — it is the state of a freshly deployed instance. Translate that into crypto. A node shipped with RPC enabled and the personal and admin namespaces exposed. A testnet faucet with a default key. A managed RPC provider whose dashboard grants a key that is really a shared project ID. A bridge relayer that accepts a message because the caller presented a header the relayer expected, not because the caller proved anything. The default is not neutral. The default is an identity, and it is almost always a privileged one. ClearPass decides what gets onto the network — an admission controller. Crypto's admission controllers are bridge validators and cross-chain relayers. A bridge does one thing: it accepts an external claim and mints or releases value on the strength of that claim. If the relayer's message-validation path can be reached unauthenticated — if it deserializes a payload it never authenticated — you have CVE-2026-76750 at chain scale. This is not hypothetical. The history of bridge losses is a history of admission failures, not cryptographic failures. The signature held. The door did not. Based on my Terra forensics in 2022, the death spiral was not a broken hash. It was a mechanism that consumed an input it never validated — an arbitrage loop that turned a trusted assumption into a liability in eleven days. Consensus is not a feature; it is the only truth. The relayer that does not authenticate its caller is not running consensus. Layer-2 sequencers run the same risk. A sequencer is a single component that orders transactions and posts them to L1. Its admin API — force-inclusion controls, batch submission, fee configuration — is a coordination layer. When it is unauthenticated, the entity that controls ordering controls the chain's entire value-extraction surface. There is no consensus to appeal to, because a sequencer is, by definition, the temporary absence of consensus. A missing auth check there is not a bug in the system. It is the system. SonicWall's SSRF is the most transferable bug of the four. The appliance issues requests on the attacker's behalf and reaches internal functionality. Every keeper bot, every oracle updater is a confused deputy by design. It holds a privileged position — an RPC connection, a signing key, a whitelisted address — and it acts on instructions from outside. If the instruction channel is unauthenticated, the deputy does the attacker's work with the system's authority. The MEV relay that accepts an order without proving the submitter. The oracle node that fetches a price from an endpoint anyone can answer. The AI-agent payment rail — the thing I prototyped on ZK-rollups in 2025 — where an agent requests a payment and the settlement layer executes it. If the agent's request path does not prove identity, the deputy pays whoever asked. I built that prototype with the auth check first. Most of the sector is building it last. The AI-agent economy sharpens the point. As autonomous agents begin to require payment rails — machine-to-machine transactions, agent tipping, tool-server billing — the control plane that authorizes those payments becomes the most valuable unauthenticated surface on the internet. Loom for AWS is not a coincidence. The agent control plane is where identity is decided, and an agent that can be impersonated is not an agent. It is a confused deputy with a wallet. The $2 billion market I sized in 2025 for agent economies assumes the auth check ships first. The Loom disclosure is evidence that it does not. A validator's slashing-protection database is a coordination interface. If an unauthenticated caller can reach it, the caller can induce a double-sign — a slashable offense that costs the validator its stake. The check that prevents this is not a cryptographic one. It is an auth header. Quantify the exposure. A coordination-layer compromise is not a data breach with a remediation SLA. It is a capital event with immediate settlement. On the enterprise side, the Loom flaw granted the ability to rewrite IAM role policies — the path from the orchestration layer into the underlying cloud environment. On-chain, the equivalent path runs from an unauthenticated relayer or sequencer into a treasury contract. The loss function is not "some records." It is "the balance," and it executes in one block. Capital efficiency cuts both ways: the same atomic composability that lets a protocol deploy liquidity in a single transaction lets an unauthenticated caller drain it in one. The Loom timeline should stop operators cold. The fix shipped Aug. 4. The disclosure published Oct. 2. Nearly two months where the missing-authentication door had a patch and no public notice, ending with a public proof-of-concept repository. The AWS bulletin shows why a version bump is not remediation: because the missing check could expose OAuth2 secrets, access tokens, and IAM session credentials, the after-upgrade list is rotate client secrets, revoke tokens, rotate session credentials, review CloudTrail. Patching restores the check. It does not restore the integrity of anything that passed through while the check was absent. That asymmetry is the whole crypto story. On-chain, there is no after-upgrade list. There is no rotation of a settled state transition. If an unauthenticated caller reaches a bridge relayer, a governance executor, a treasury module, or a validator's slashing-protection interface, the resulting transaction is final. You cannot revoke a block. You cannot rotate a signature out of existence. The enterprise operator gets a remediation window measured in weeks and a forensic log to reconstruct. The on-chain operator gets a reorg — if the chain is young and they are lucky — and nothing if they are not. Consensus is not a feature; it is the only truth, and truth on-chain is irreversible. The four advisories share a footnote: no active exploitation is reported, and none sits in CISA's Known Exploited Vulnerabilities catalog. That footnote is comfort, not safety. An unauthenticated critical function is not a vulnerability waiting for a threat actor; it is an open door waiting for a scanner. The distinction between "not exploited" and "not exploitable" is the distinction between luck and design, and only one of them is a control. Here is the counterintuitive part, and it cuts against how the sector audits. The private-network assumption that produces CWE-306 is indefensible in enterprise. It is false in crypto, because the network is public by construction. The secondary channel is not on a private LAN. It is on the internet, with a DNS name, indexed by Shodan, scanned every minute. Teams still scope it out. Auditors still scope it out, because audits are scoped to the primary surface — the contract, the consensus logic, the cryptographic primitive — and the coordination interface is filed under infrastructure, which is filed under somebody else's problem. The economics explain why. An audit is priced against a scope, and the scope is the primary surface, because that is where the client believes the value is. The coordination interface is priced as infrastructure, and infrastructure is priced as a version bump and a changelog. So the secondary channel is never in the line item, and the finding that would have caught it is never filed. The four vendors here did not have a cryptography problem. They had a scoping problem that their auditors inherited. The bug is not the missing check. The bug is the belief that the check was unnecessary. Inventory the control-plane interfaces. Enumerate every endpoint that arbitrates trust — RPC, sidecar, relayer, keeper, agent API — and ask one question of each: does it prove who is asking? Builders: stop filing the secondary channel under somebody else's problem. The private network was the assumption. The assumption is the bug. The next loss will not be a broken signature. It will be an interface that never asked for one — and on-chain, the only remediation is the one you cannot perform: undo finality.