[Yuqing (mydmdm)]

Summary

• require a configured PARROT_API_KEY bearer token for every ServeCore HTTP request and validate it again when sessions are created
• issue a unique cryptographically random capability for every session and verify it on every session, call, and semantic-variable operation
• remove the client-bytecode deserialization and execution path; /v1/py_native_call returns 410 Gone
• remove HTTP-controlled Parrot engine registration and heartbeat handling
• remove vendored FastChat worker registration, status-fetch, and worker-proxy outbound request paths
• document the intentional breaking changes and provide an isolated legacy-tag clone command
• add targeted authentication, disabled-endpoint, and session-credential regression tests

Reported finding coverage

Finding	Remediation
Client-supplied Python bytecode (CWE-94/CWE-502)	Fixed: marshal serialization utilities and the server-side FunctionType construction/data flow were removed; the endpoint returns 410 Gone.
Parrot engine-registration SSRF (CWE-918)	Fixed: HTTP registration/heartbeat reject requests and ServeCore no longer constructs engines from request payloads.
Vendored FastChat worker-registration SSRF (CWE-918)	Fixed: dynamic registration and proxying reject requests; attacker-controlled worker status/proxy requests.post sinks were removed.
Missing API authentication (CWE-306)	Fixed: ServeCore refuses startup without PARROT_API_KEY, all endpoints enforce bearer authentication, and session creation validates the key.
Cross-session ownership (CWE-639)	Fixed: each session receives an independent 256-bit random capability that is checked before every session-scoped operation.

Breaking changes

Python native calls and dynamic backend registration are intentionally unavailable. The vulnerable baseline is upstream commit 2e1825ee2bc38cb783bab9d8ec3e5ae99a93ba46. The annotated upstream tag legacy-unsafe-pre-security-hotfix has been published at that commit. The README labels it unsupported/known-vulnerable and gives a clone command using https://github.com/microsoft/ParrotServe.git for isolated security environments.

Validation

• python3 -m pytest -q tests/serve/test_http_security.py (6 passed)
• python3 -m py_compile ... for all changed Python modules and tests
• git diff --check
• repository search confirms no remaining marshal.loads/marshal.dumps, function-code serialization helpers, request-controlled EngineConfig(**payload), or FastChat worker requests.post sink

[Yuqing (mydmdm)]

Release prerequisite: publish the legacy tag in the upstream repository before advertising the README clone command:

git tag -a legacy-unsafe-pre-security-hotfix 2e1825ee2bc38cb783bab9d8ec3e5ae99a93ba46 \
  -m "Known-vulnerable snapshot before security hardening; isolated historical reproduction only"
git push origin legacy-unsafe-pre-security-hotfix

The tag currently present in the PR source fork does not make an upstream clone command work; it must be created by a maintainer with push access to microsoft/ParrotServe.

[Yuqing (mydmdm)]

The upstream annotated legacy-unsafe-pre-security-hotfix tag is now published at 2e1825ee2bc38cb783bab9d8ec3e5ae99a93ba46. The README clone command has been verified against the public upstream tag.