This repository was archived by the owner on Sep 8, 2026. It is now read-only.
Repository navigation
This repository was archived by the owner on Sep 8, 2026. It is now read-only.
Bug: default Engine API JWT secret is hardcoded while authrpc binds to 0.0.0.0 #1086
Closed as not planned
Description
The default node configuration includes a hardcoded BASE_NODE_L2_ENGINE_AUTH_RAW value. The Reth entrypoint writes this value into the JWT file used by --authrpc.jwtsecret, while also starting authrpc on 0.0.0.0.
This means every node using the default configuration shares the same Engine API JWT secret.
Although docker-compose.yml does not publish port 8551 by default, this is still a dangerous default for operators using host networking, Kubernetes, custom compose files, manual port mappings, or shared Docker networks. If authrpc becomes reachable, the JWT secret is already public because it is committed in the repository.
Activity
mssystem1 commentedon May 18, 2026
Steps:
Open .env.mainnet
Notice that BASE_NODE_L2_ENGINE_AUTH_RAW is set to a fixed hardcoded value:
BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
Open reth/reth-entrypoint
Notice that the entrypoint writes the raw value into the JWT file:
echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
In the same file, notice that Reth starts authrpc on all interfaces:
--authrpc.addr=0.0.0.0
--authrpc.port="$AUTHRPC_PORT"
--authrpc.jwtsecret="$BASE_NODE_L2_ENGINE_AUTH"
Run the node with default env values
Any deployment that exposes authrpc port 8551, uses host networking, or places untrusted services on the same network now uses a public, shared JWT secret
mssystem1 commentedon May 18, 2026
Expected behavior:
The Engine API JWT secret should be unique per node and should not be committed as a static default.
authrpc should bind to localhost or the internal Docker network by default, not 0.0.0.0, unless the operator explicitly opts in.
mssystem1 commentedon May 18, 2026
Suggested fix:
Example shell logic:
if [ -z "${BASE_NODE_L2_ENGINE_AUTH_RAW:-}" ]; then
if [ ! -f "$BASE_NODE_L2_ENGINE_AUTH" ]; then
openssl rand -hex 32 > "$BASE_NODE_L2_ENGINE_AUTH"
fi
else
echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
fi
Also consider changing:
--authrpc.addr=0.0.0.0
to:
--authrpc.addr=127.0.0.1
or document very clearly that exposing authrpc with the default JWT is unsafe.
erhnysr commentedon May 20, 2026
PR #1087 is ready for review: #1087
fix: remove hardcoded Engine API JWT secret and require explicit conf…
fix: remove hardcoded Engine API JWT secret and require explicit conf…
github-actions commentedon Jun 6, 2026
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
github-actions commentedon Jun 12, 2026
This issue was closed because it has been inactive for 5 days since being marked as stale.