tier1Gate TOCTOU: non-atomic check-then-reset enables concurrent runs
Finding PUB-F016 · f6b87aafab0a · discovered by pentest-public-51classes-20260611
MEDIUMconfirmedexcessive-agencyopus48artifact backed
- Target
- OhanaSec/jc-pentest-harness
- Target URL
- not recorded
- Run status
- completed · api-multi-model
- Framework
- agentic
- Priority score
- 0.5800
- Reachability
- unknown
- Chain depth
- 1
- PoC available
- no
- Asset
- not recorded
- Discovered
- Jun 11, 2026, 02:20 PM
Description
The gate check and reset are not atomic, so two concurrent runs can both observe an armed gate and proceed past per-run budget controls.
Validation
No validation rationale recorded.
Remediation
Make gate check-and-reset atomic (compare-and-swap / advisory lock).
Evidence Boundary
This page shows persisted finding evidence, validator rationale, target context, and run linkage. Raw prompts, raw target responses, provider payloads, secrets, cookies, and authorization headers are not rendered publicly. Use the linked run page for class execution evidence, run logs, cost events, and pipeline errors.