user-1: I was reading about CVE-2018-20586 which allowed injection of arbitrary data into the debug log via an RPC in https://medium.com/@lukedashjr/cve-2018-20586-disclosure-ff3e1ab9a21f
One thing that I couldn't understand:

Valid authentication (username/password/cookie) for the RPC service is NOT required to exploit this vulnerability, only the ability to connect to the RPC port (which is by default only exposed to the local machine).

Does this ability to connect to RPC port without authentication still exist because I had to use basic auth last time I tried sending POST requests locally?

user208: When it says, "connect" it is referring to connecting in the TCP/IP sense. The vulnerability simply required you having the ability to open a TCP/IP connection to bitcoind's RPC port, which is before any concept of authentication even comes into play.
It isn't that it was possible to send JSON-RPC commands to bitcoind without authentication (this was never possible). It's that the attack occurs before authentication takes place.

-1: <p>I was reading about CVE-2018-20586 which allowed injection of arbitrary data into the debug log via an RPC in <a href="https://medium.com/@lukedashjr/cve-2018-20586-disclosure-ff3e1ab9a21f" rel="nofollow noreferrer">https://medium.com/@lukedashjr/cve-2018-20586-disclosure-ff3e1ab9a21f</a></p>
<p>One thing that I couldn't understand:</p>
<blockquote>
<p>Valid authentication (username/password/cookie) for the RPC service is NOT required to exploit this vulnerability, only the ability to connect to the RPC port (which is by default only exposed to the local machine).</p>
</blockquote>
<p>Does this ability to connect to RPC port without authentication still exist because I had to use basic auth last time I tried sending <a href="https://bitcoin.stackexchange.com/questions/105838/rate-limits-bitcoin-core-json-rpc">POST requests</a> locally?</p>
 208: <p>When it says, &quot;connect&quot; it is referring to connecting in the TCP/IP sense. The vulnerability simply required you having the ability to open a TCP/IP connection to <code>bitcoind</code>'s RPC port, which is before any concept of authentication even comes into play.</p>
<p>It isn't that it was possible to send JSON-RPC commands to <code>bitcoind</code> without authentication (this was never possible). It's that the attack occurs before authentication takes place.</p>
