# Root Cause Analysis & Corrective Actions — CVD-2026-0012

**Incident:** CVD-2026-0012 — path-traversal in artifact-serving endpoint
**Organisation:** Meridian Systems
**Incident Commander:** Lena Hartmann
**Stage:** 6 — Close, Disclose & Learn
**Date (IC sign-off):** 2026-04-12
**Classification:** Internal — post-incident. *All entities, people, and findings are fictional.*

> **Note on the AI-assisted draft.** The RCA structure and initial causal chain were drafted by the configured LLM agent in Stage 6, operating from the incident record and the Stage 3 evidence-chain integrity assessment. The IC made two corrections before signing:
>
> 1. The AI draft attributed a root cause to "inadequate credential-rotation frequency" and recommended monthly rotation as a corrective action. The record shows that Meridian's rotation policy was followed on schedule — the last rotation ran 38 days before T0, within the defined 90-day cycle. The AI inferred a frequency problem that the evidence does not support. **The IC removed this finding.** The actual gap was scope: pipeline variables were not enumerated in the rotation-policy definition and were therefore excluded from every rotation cycle regardless of frequency. The token was 14 months old not because rotation was too infrequent but because it was never in scope.
> 2. The AI draft listed "patch deployed to production" as a containment action. Patching is remediation, not containment — the token had already been extracted before the patch. The IC moved the patch deployment to the Remediate & Recover section.
>
> The timeline reconstruction, detection-gap analysis, and corrective-action recommendations were accepted as accurate and are reproduced below with minor editorial edits.

---

## Timeline

| Date / time (UTC) | Event |
|---|---|
| 2026-03-12 00:00 | Meridian Systems ships version 3.4.0. The path-traversal vulnerability is introduced in the artifact-serving endpoint (`/api/v2/artifacts/{id}/download`). It is not flagged in the pre-release security review; the endpoint was classified as a "minor feature" addition. |
| 2026-04-07 03:21–03:44 | Three targeted read operations are made against Meridian's compliance-platform evidence store using the exposed service-account token. Consistent with the researcher's proof-of-concept script. No alert is raised. |
| 2026-04-07 14:09 | An independent researcher submits a vulnerability report via `security@meridian-systems.example` (the published `security.txt` address). The report includes a working proof-of-concept and states that the token was retrieved before the report was written. |
| 2026-04-07 14:09 – 2026-04-08 08:45 | The report sits in the security inbox unread. No after-hours alert is configured for `security.txt` submissions. Total inbox latency: **18 hours 36 minutes**. |
| 2026-04-08 08:45 | A security engineer opens the inbox and triages the report. Marc Dubois (Security Lead) is escalated immediately. |
| 2026-04-08 10:23 | Marc Dubois independently reproduces the proof-of-concept in a controlled environment. Exploitation corroborated. **T0 stamped.** Statutory clocks start. |
| 2026-04-08 11:15 | Incident declared. Lena Hartmann named IC. Stage 1 gate signed. |
| 2026-04-08 13:04 | Regulatory scope memo signed. Stage 2 gate signed. |
| 2026-04-08 14:45 | The vulnerable endpoint on Meridian's staging cloud subscription taken offline as an emergency containment measure. Releases frozen; the pipeline is treated as untrusted pending the provenance audit. |
| 2026-04-08 15:30 | Exposed token `svc-meridian-sync@compliance` revoked. All pipeline-variable credentials on the staging cloud subscription rotated. |
| 2026-04-08 19:22 | Customer notifications sent to Sint-Aldegonde Hospital Group and the NDIA. Sint-Aldegonde receives notification T+8h59m before their own Art. 23 clock would expire. |
| 2026-04-11 10:17 | GDPR Art. 33 notification filed with the BE DPA, 6 minutes before the T0+72h deadline. |
| 2026-04-12 09:00 | Evidence re-attestation for three provisionally untrusted control artefacts completed. Stage 5 gate signed. |
| 2026-04-12 | This RCA signed and filed. Stage 6 gate signed. CVE advisory published, crediting the reporter. |

---

## Causal chain

**Immediate cause:** The path-traversal vulnerability in the artifact-serving endpoint (`/api/v2/artifacts/{id}/download`) allowed directory traversal outside the designated artifact root, exposing the pipeline runner's working directory and its environment file, which contained the compliance-platform service-account token in plaintext.

**Contributing cause 1 — plaintext pipeline variable.** The compliance-platform token was stored as a plaintext pipeline variable in the CI/CD pipeline runner running on Meridian's staging cloud subscription, rather than using the secret-management integration available in the pipeline runner since version 2.8.0. This meant the token existed in the filesystem and was reachable via the path-traversal exploit.

**Contributing cause 2 — rotation scope exclusion.** Meridian's credential-rotation policy defines its scope as "production API keys and OAuth client credentials." Pipeline variables were not enumerated in the scope. The token was 14 months old at T0 — it had never been rotated, not because the rotation cycle was too long, but because the token was outside the rotation scope.

**Contributing cause 3 — no after-hours alert for `security.txt`.** The security inbox had no on-call alert. The researcher's report arrived at 14:09 on a weekday and was not read until the following morning — 18 hours 36 minutes later, on a report asserting active exploitation.

**Systemic context:** The vulnerable endpoint was added in a minor-release cycle and received no focused security review for path-traversal risks. The pre-release security review checklist did not include a mandatory check for new file-serving or download paths.

---

## Detection gaps

| Gap | Detail | Lag contribution |
|---|---|---|
| No after-hours `security.txt` alert | The full 18h36m inbox latency between the researcher's report (14:09 Apr 7) and triage (08:45 Apr 8) was preventable with an on-call alert. | 18h36m of the 20h14m total CVD-to-T0 lag |
| No anomaly detection on compliance-platform token usage | The three anomalous API calls at 03:21–03:44 on Apr 7 were not flagged in real time. Detection required manual audit-log review after T0. An alert on out-of-hours token activity would have provided approximately 31 hours of advance warning. | ~31h potential early detection missed |
| No pipeline-variable audit | The token's age (14 months) and plaintext storage were not surfaced before the incident. A periodic audit of pipeline-variable credential age and storage method would have caught both gaps. | Latent exposure duration: 27 days from v3.4.0 ship |

**CVD-to-T0 lag summary:** The researcher discovered the vulnerability on 2026-04-07 and reported it at 14:09. T0 was stamped 2026-04-08 10:23 — a lag of **20 hours 14 minutes**. Of that, 18 hours 36 minutes was preventable inbox latency.

---

## Containment gaps

| Gap | What happened | What should have happened |
|---|---|---|
| Token revocation not simultaneous with endpoint takedown | The endpoint was taken offline at 14:45; the token was revoked at 15:30. The token remained live for 45 minutes after the endpoint was taken offline. | Token revocation should be simultaneous with or before any containment action on the endpoint. Taking down the endpoint does not neutralise a credential already in an adversary's hands. |
| Release freeze lifted before provenance audit signed off | During Stage 5 recovery, the release freeze was lifted to ship the patch before the Tech Lead had signed off the full artifact-provenance audit for the 27-day exposure window. The provenance audit was completed retrospectively, after the patch had shipped. | The release freeze should be gated on the provenance audit sign-off, not on the patch being ready to ship. |

---

## Corrective actions

| # | Finding | Action | Owner | Due |
|---|---|---|---|---|
| CA-1 | `security.txt` inbox had no after-hours alert | Configure an on-call alert (PagerDuty) for any new submission to the security inbox; route to the duty security engineer | Marc Dubois | 2026-04-22 |
| CA-2 | Compliance-platform token stored as plaintext pipeline variable | Migrate all service-account credentials from plaintext pipeline variables to the secret-management integration; prohibit plaintext pipeline variables for credentials in the pipeline-hardening runbook | Sofia Nkosi (Tech Lead) | 2026-04-30 |
| CA-3 | Pipeline variables excluded from credential-rotation policy scope | Amend the rotation policy to enumerate pipeline variables explicitly; run an immediate rotation sweep for all pipeline-variable credentials older than 90 days | Rachel Stern | 2026-04-22 |
| CA-4 | No anomaly detection on compliance-platform API token usage | Configure compliance-platform API usage alerting for calls outside the expected sync schedule; define baseline and alert threshold | Marc Dubois | 2026-05-06 |
| CA-5 | GDPR Art. 33 legal-assessment lag (6 minutes to spare) | Pre-map Meridian's data-controller status for each data category held in the compliance platform; document and keep current so Art. 33 scope can be determined in hours, not days | Rachel Stern | 2026-05-15 |
| CA-6 | Token revocation not simultaneous with endpoint takedown | Update the incident-containment runbook: credential revocation simultaneous with or before any containment action on the endpoint; add as an explicit first action in the Stage 3 task order | Lena Hartmann | 2026-04-22 |
| CA-7 | Release-freeze lift not gated on provenance audit sign-off | Update the Stage 5 gate criteria: release freeze lifted only after artifact-provenance audit is signed by the Tech Lead | Lena Hartmann | 2026-04-22 |
| CA-8 | New file-serving endpoint had no mandatory path-traversal check in the pre-release review | Add a mandatory path-traversal check to the security review checklist for any new endpoint that serves files or handles download paths | Sofia Nkosi | 2026-05-06 |

---

**Prepared by:** Lena Hartmann, Incident Commander
**AI draft reviewed and corrected:** as noted above; two findings removed or repositioned
**Exec sponsor sign-off:** James Whitfield, 2026-04-12
**Filed in:** compliance-platform evidence locker, folder `incidents/CVD-2026-0012`, as part of Stage 6 close