admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R-1303 built and live-proven (test mail arrived, seed run committed its memory); R-1305–R-1309 filed (file manager, 27 apps, image packages, floating tags, mail-only notices); docs 08 §11, B23, monthly §4a; STATUS
gates / gates (push) Successful in 2m21s
Details

Browse Source
This commit is contained in:
admin committed 2026-10-26 23:51:45 +01:00
1 parent ed843da788
commit 626275b187
10 files changed
+2465 -14
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

REPORT-security-watch-2026-10-26.md
+86
View File
@@ -0,0 +1,86 @@
# REPORT — the nightly security watch (R-1303), 2026-10-26 night
> A sibling of `REPORT.md`: the night session owns `REPORT.md` tonight. Readings taken alone (the brief's „safest
> reading", stated first):
> 1. **The key:** the operator said yes; the token did not exist by the end, so the watch runs in no-key mode (box
> programs nightly, apps' advisory lists every second night) and switches by itself when `GH_ADVISORY_TOKEN` exists.
> The name is `GH_…`, not `GITHUB_…`: Gitea reserves the `GITHUB_` and `GITEA_` prefixes for Actions secrets.
> 2. **The memory:** a file the CI job commits to `main` itself (`documentation/security-watch/state.json`), not the
> runner's disk (two runners, two disks), not the Actions cache (needs a node step), not DooPlex (a host change).
> 3. **A seed that could not read everything** (no key) leaves those pins pending; their first real read is recorded
> silently. Otherwise the first nights after the seed would have been the mail storm the brief forbids.
## In plain words
1. **Sources picked:** GitHub's per-repo security advisories (the main source), GitHub release notes, the Cloudflare
blog plus cloudflared's own `VULN-` notes, OSV for our Go builders, and the registries for „newer version". **They
cannot see:** a fix told only by mail, forum or a blog we do not read; a security fix nobody calls one; packages inside
our own images (Debian, Alpine, Samba); closed-source apps (Plex, Emby); floating tags like `redis:7-alpine`.
2. **Watched:** 108 pins — 11 box programs and build bases, 97 catalog images (21 of them with a stated „no source").
3. **First real run (the seed, CI job 2408):** ADVISORY on **30 pins (142 notices)**: 3 box programs (traefik, the file
manager, cloudflared) and 27 apps; BEHIND on 17; 0 NOT CHECKED. Nothing was mailed — the seed records them.
4. **The test mail arrived:** yes — „[Felhom security] TEST — not a real advisory …" in the admin@felhom.eu mailbox
(Resend id `01a17a5d-…`, CI job 2407).
5. **The operator does:** make the GitHub key and store it as `GH_ADVISORY_TOKEN` (CC's store and Gitea Actions). Then
decide the order of triage for the advisory list (R-1305, R-1306).
## The ADVISORY list today (box programs first; full list `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md`)
| Program | Our version | Fixed in (notices) |
|---|---|---|
| traefik | v3.7.13 | v3.7.14–v3.7.16 (15; triage: none seems to apply to our config — R-1304) |
| file manager (FileBrowser Quantum) | 1.5.6-stable | 1.5.7-stable for 2 of 36 (GHSA-qx86, needs the password; GHSA-3846); the rest on 2.x (R-1305) |
| cloudflared | 2026.10.3 | 2026.10.4 (VULN-176088, metrics allowlist; our metrics are on the container's own loopback) + the eMudhra blog post (already fixed, R-1300) |
| 27 apps | — | e.g. Jellyfin 10.11.11 → 12.0; Gokapi 1.9.6 → 2.2.4; Seerr 2.7.3 → 3.5.0; Wanderer v0.20.0 → v0.21.2; Rallly 4.15.3 → 4.15.4; Immich v3.2.4 → v3.3.5 (notes); SparkyFitness: no fix yet (R-1306) |
## Commits and CI (by commit)
| Repo | Commit | What | CI |
|---|---|---|---|
| felhom.eu | `97ae7086` | spike + rows R-1303, R-1304 | job 2401 success |
| felhom.eu | `1f62d629` | the watch, the shared list + gate, tests, workflow | job 2402 success |
| felhom.eu | `6ee23a3b` | abandoned = GAP; seed-pending | (see below) |
| app catalog | `f61800a` | `upstream:` in 65 templates, gate + decoys, checklist 1.10 | job 2403 success |
| controller | `e01eb64b` | `upstream.txt`, `# upstream:` comments, gate + decoys | job 2404 success |
| felhom.eu | `ed843da7` | the memory, committed by the CI job itself | — |
| felhom.eu | (this commit) | docs, rows R-1305–R-1309, STATUS, this report | read at the end |
Live runs in CI: job 2405 (dry: every host reached; 30 NOT CHECKED because DooPlex's shared GitHub quota was at 0 —
printed and counted, the reason for the key), 2407 (test mail), 2408 (seed; memory pushed). Tests: 38 checks, no
network; red-proved five ways (dedupe, streak, the 30-day window, a swallowed source error, the seed-pending set); the
two gates' decoys red-proved with a reader that reads comments.
## Rows
Before **215**, after **222**; opened **7** (R-1303 – R-1309), closed **0**.
## Observations
- traefik v3.7.13 inside 12 October advisories — **FILED: R-1304**.
- The file manager 1.5.6-stable inside 36 notices, 2 fixed in its own channel — **FILED: R-1305**.
- 27 app pins with published notices — **FILED: R-1306** (one row; the list is the file).
- Packages inside our own images not watched — **FILED: R-1307**. Floating tags — **FILED: R-1308**. Mail-only and
silent fixes, closed-source apps — **FILED: R-1309**.
- Three upstream repos renamed (cal.com → `calcom/cal.diy`, jellyseerr → `seerr-team/seerr`, wanderer →
`open-wanderer/wanderer`) — **NOT-A-FINDING: the mapping uses the new names; the images still pull.**
- plant-it's image name points nowhere — **NOT-A-FINDING: known and stated in its template (abandoned); the watch lists
it as GAP and never looks it up.**
- The hub's Dockerfile lines are not gated in felhom.eu's own runner (only the catalog's and the controller's are) —
**NOT-A-FINDING: the watch reads them nightly and reports a missing line as NOT CHECKED; a gate there would need its
own decoy suite for two lines.**
- nginx's channel test treats 1.31 (mainline) as the same channel as 1.30 (stable) — **NOT-A-FINDING: BEHIND is a weekly
hint; the notice match does not depend on it.**
- Without a key, the dry run spent DooPlex's whole GitHub quota (shared with every DooPlex client) — **NOT-A-FINDING:
that is R-1303's „blocked on"; the watch reported it as NOT CHECKED, as designed.**
## Documents changed
`runbooks/monthly-floating-retest.md` §4a (the BEHIND check is nightly; the monthly run keeps the same-name re-test);
`architecture/capability-map-detail/B.md` B23 (a watch mail starts the lane); `architecture/08-alarm-ladder.md` §11 (the
three signals, `[DESIGN]`); `scripts/CHANGELOG.md`; `REUSE.md`; the catalog's `NEW-APP-CHECKLIST.md` 1.10. System
poster: none of the three needed — no machine, path, backup tier or key changed (a CI job reads public sources).
## Teardown
Machine and host: nothing provisioned. Hub: nothing. CI: three manual runs, no lasting change but the memory file. Work
copies `felhom.eu-cfsec`, `app-catalog-cfsec`, `felhom-controller-cfsec` on DooPlex: removed at the end, all pushed.
STATUS.md
+11 -11
View File
@@ -23,7 +23,7 @@
- DooPlex: something sets the shared checkout to „bare" (R-935).
## What we work on
- Released: 0.345.1 (cloudflared 2026.10.3, security), every box. Built, not released (Tuesday's block, each on your yes): R-1291, R-1220, R-1232, R-1187, R-1219, R-1298, R-972, R-1285. R-1218 needs you: off-site off on Tester 1 for minutes (hub customer page), or it leaves the release.
- Built, not released (Tuesday's block, each on your yes): R-1291, R-1220, R-1232, R-1187, R-1219, R-1298, R-972, R-1285. R-1218 needs you: off-site off on Tester 1 for minutes (hub customer page), or it leaves the release.
- Dated checks, run by CC. 2026-10-27: the line test on a seeding box, DooPlex's qBittorrent as the peer (R-1250, your yes). 2026-10-30: D35, website and installer to Cloudflare, starts (R-1228, ruled yes).
## Waiting on you — decide
@@ -40,22 +40,22 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te
## Waiting on you — do
**Still needed? (yes/no)** — CC could not check these. Answer yes or no per line.
1. Look at `roms/roms/` on the N100's drive in the file manager (R-1099). Since 2026-10-16.
2. The N100 sheet, about 30 minutes: Plex, the admins in Prowlarr, Sonarr and Radarr, your download sources (`documentation/audits/n100-lived-in-2026-10-15/SHEET.md`). Since 2026-10-15.
3. Look at these demo-hp pages when you have time: Calibre-Web, the file manager, AdventureLog, Plex, the app page, the Plex and Sonarr guides. Since 2026-10-16.
4. Remove the test server „plex-k6" from your Plex account (plex.tv → Settings → Authorized Devices). Since 2026-10-15.
5. Ask Google to index `https://felhom.eu/sajat-felho-tarhely` in Search Console (R-1035). Since 2026-10-14.
6. BIOS: on the N100, read „After Power Loss"; on the HP, set „Bypass F1 Prompt on Configuration Changes" to Enable. Since 2026-10-14.
7. Pin the first Facebook post (R-917), and look at the new cover in the Facebook phone app (R-919). Since 2026-10-12.
1. Look at `roms/roms/` on the N100's drive in the file manager (R-1099). (since 10-16)
2. The N100 sheet, about 30 minutes: Plex, the admins in Prowlarr, Sonarr and Radarr, your download sources (`documentation/audits/n100-lived-in-2026-10-15/SHEET.md`). (since 10-15)
3. Look at these demo-hp pages when you have time: Calibre-Web, the file manager, AdventureLog, Plex, the app page, the Plex and Sonarr guides. (since 10-16)
4. Remove the test server „plex-k6" from your Plex account (plex.tv → Settings → Authorized Devices). (since 10-15)
5. Ask Google to index `https://felhom.eu/sajat-felho-tarhely` in Search Console (R-1035). (since 10-14)
6. BIOS: on the N100, read „After Power Loss"; on the HP, set „Bypass F1 Prompt on Configuration Changes" to Enable. (since 10-14)
7. Pin the first Facebook post (R-917), and look at the new cover in the Facebook phone app (R-919). (since 10-12)
**2026-10-26.** On the hub's Hosts page, delete `Tester4-b5dbbd` (CC's test VM of tonight, uninstalled and destroyed; you already deleted `Tester4-b5ec39`). If not: the hub alarms that the box went silent. After demo-hp's window has run (CC says when, Tuesday morning), revoke the token `cc-d55-window` (R-1294).
**2026-10-26.** On the hub's Hosts page, delete `Tester4-b5dbbd` (CC's test VM of tonight, uninstalled and destroyed; you already deleted `Tester4-b5ec39`). If not: the hub alarms that the box went silent. After demo-hp's window has run (CC says when, Tuesday morning), revoke the token `cc-d55-window` (R-1294). New: a nightly security watch mails you (R-1303); make it a GitHub key, no repo access, as `GH_ADVISORY_TOKEN`.
**2026-10-23 do list.**
1. Print the break-glass sheet (`documentation/runbooks/break-glass-sheet.md`, the part from „The sheet”, one A4), fill it by hand, keep it outside the home (D32; R-923, R-924). If not: after a DooPlex loss no off-site copy opens.
2. On the hub's Hosts page: Discard appliance 49. If not: a dead entry alarms.
3. Give the homelab session R-1241, R-1242, the lists at the end of `documentation/audits/plex2shell-felhom-impact-2026-10-23/README.md` and `documentation/audits/dooplex-alarms-2026-10-24/README.md`, and an upload alarm on DooPlex's `eno1` (~100 Mbit/s line; the flood peaked at 905). If not: the next hacked app on DooPlex can read the hub's backups.
**The rest**
- System poster needs a refresh: the new 01:40 „release copy” arrow from DooPlex to ep0 (D33); the hub-database label already says every 6 hours. If not: the drawing misses one copy.
- Rotate the reused homelab logins and decide the Gitea repo's visibility (R-925, P1). Since 2026-10-09.
- Two DooPlex leftovers: `leftovers/2026-10-14/first-post/` (keep or delete); the `deny`-list edit in homelab-manifests' `.claude/settings.json` (commit or drop). Since 2026-10-14.
- Rotate the reused homelab logins and decide the Gitea repo's visibility (R-925, P1). (since 10-09)
- Two DooPlex leftovers: `leftovers/2026-10-14/first-post/` (keep or delete); the `deny`-list edit in homelab-manifests' `.claude/settings.json` (commit or drop). (since 10-14)
- Before the first paying customer: Tandoor's permission (R-789); a lawyer for the licence list and the terms (R-802, R-813); SparkyFitness by e-mail (R-784).
- Later (yours, not urgent): R-1250 (a seeding qBittorrent is never tested), R-1248 (a hard upload cap per app), R-1229 (ArgoCD's sync settings into git), R-862 (Tester 2's bootstrap, when it is back), R-504, R-1071, R-1073, R-1077, R-1042, R-132, R-908, R-779, R-904, R-232, R-433, R-933, R-213, R-832, R-388, R-882, R-883, R-814, R-1056, R-1164, R-930, R-920, R-902.
documentation/architecture/08-alarm-ladder.md
+17
View File
@@ -662,3 +662,20 @@ every grace — a test configuration only. Live proof: `audits/d53-held-apps-202
every household leg `skipped operator_only`).
*[DESIGN] R-1298 (2026-10-26 night, controller main `b156e45`): an install's hold (`unhealthy_stop`, `update_failed`, `putback_pending`) of an app that is NOT installed (no `app.yaml`) is not reported — it would remind weekly about an app that does not exist; a restore hold is always reported (R-379, a person clears it).*
## 11. The security watch — three operator-only signals [DESIGN — built 2026-10-26: felhom.eu `1f62d629`, `6ee23a3b`; R-1303]
The nightly CI job `security-watch` (03:40 UTC, `scripts/security_watch.py`) reads where each shipped program publishes
its security notices (sources and their limits: `audits/security-watch-2026-10-26/SPIKE.md`) and mails **admin@felhom.eu
only** — no household, no hub event:
| Signal | When | Once? |
|---|---|---|
| **ADVISORY** — „[Felhom security] <programs, box first> — N new advisories" | a notice affects the version we pin | once per (program, notice); a reminder every 7 days while it stays open; a vendor-blog notice never repeats |
| **BEHIND** — „[Felhom security] weekly: …" | Monday (or the last summary is 8+ days old) | one summary; it also lists GAP, FLOATING and tonight's NOT CHECKED |
| **NOT CHECKED** — „[Felhom security] the watch could not check …" | the same source failed two nights in a row | once per streak; a good night resets it |
The memory is `documentation/security-watch/state.json`, committed by the job itself; a missing memory re-seeds AND mails
that it did. A job that does not finish mails „[felhom CI] security watch FAILED". The mail starts the security-fix lane
(capability map B23).
documentation/architecture/capability-map-detail/B.md
+4
View File
@@ -392,6 +392,10 @@ four version observables at TO, a 600 s memory soak), and the only writer turns
ladder step. Every box on controller >= 0.341.0 takes it at night with the usual guards (backup first, undo on a
failed health check, held / stopped / needs_person / W+5h respected).
**Trigger (2026-10-26, R-1303):** a mail from the nightly security watch („[Felhom security] …", `08` §11) starts the
lane: it names the program, our version and the fixed version. An app notice goes this lane; a box program's (traefik,
cloudflared, the file manager) is a controller release — the cloudflared 2026.10.3 run (R-1300) is the worked example.
**Components:** catalog `3898593` (`ladder.py check_security`, the two test-record gates, `upgrade-test.py --write-ladder
--security`, `box_walk.py --security`); controller v0.341.0 (`legCandidate`).
documentation/audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md
+39
View File
@@ -0,0 +1,39 @@
# Open advisories at the first run — 2026-10-26 (security watch seed, CI job 2408)
One row per pin. „Fixed in" lists every fixed version the notices name. A seed mails nothing; this is the list it
would have mailed. Box programs first. Full text: `ci-seed.log` (WOULD HAVE MAILED).
| Program (owner) | Our version | Notices | Fixed in | Worst severity | Sources |
|---|---|---|---|---|---|
| cloudflare/cloudflared (controller infra) | 2026.10.3 | 2 | 2026.10.4; read the notice | not given | release notes (cloudflared), vendor notice (cloudflare-blog) |
| gtstef/filebrowser (controller infra) | 1.5.6-stable | 36 | 1.5.7-stable, 2.0.10-beta; 1.5.7-stable, 2.0.8-beta; 2.0.0-stable; 2.0.0-stable, 2.0.10-beta; 2.0.1-stable; 2.0.1-stable | high | GitHub advisory, release notes |
| traefik (controller infra) | v3.7.13 | 15 | v3.7.14; v3.7.15; v3.7.16 | high | GitHub advisory, release notes |
| codewithcj/sparkyfitness (sparkyfitness) | v0.17.3 | 3 | no fixed version named yet | medium | GitHub advisory |
| codewithcj/sparkyfitness_server (sparkyfitness) | v0.17.3 | 3 | no fixed version named yet | medium | GitHub advisory |
| docmost/docmost (docmost) | 0.96.0 | 1 | v0.97.0 | not given | release notes |
| f0rc3/gokapi (gokapi) | v1.9.6 | 10 | 2.2.3; 2.2.4; v2.0.0 | high | GitHub advisory |
| fallenbagel/jellyseerr (seerr) | 2.7.3 | 6 | 3.1.0; 3.4.0; 3.5.0 | high | GitHub advisory |
| flomp/wanderer-db (wanderer) | v0.20.0 | 11 | v0.21.0; v0.21.2 | critical | GitHub advisory, release notes |
| flomp/wanderer-web (wanderer) | v0.20.0 | 11 | v0.21.0; v0.21.2 | critical | GitHub advisory, release notes |
| freikin/dawarich (dawarich) | 1.15.3 | 1 | 1.17.0 | not given | release notes |
| ghcr.io/advplyr/audiobookshelf (audiobookshelf) | 2.37.1 | 1 | v2.37.2 | not given | release notes |
| ghcr.io/alam00000/bentopdf (bentopdf) | v2.8.6 | 5 | no fixed version named yet; v2.8.10; v2.8.7 | medium | GitHub advisory, release notes |
| ghcr.io/cmintey/wishlist (wishlist) | v0.67.1 | 2 | v0.68.0; v0.69.0 | not given | release notes |
| ghcr.io/home-assistant/home-assistant (home-assistant) | 2026.9.4 | 1 | the range is unreadable — check by hand | low | GitHub advisory |
| ghcr.io/immich-app/immich-machine-learning (immich) | v3.2.4 | 2 | the range is unreadable — check by hand; v3.3.5 | critical | GitHub advisory, release notes |
| ghcr.io/immich-app/immich-server (immich) | v3.2.4 | 2 | the range is unreadable — check by hand; v3.3.5 | critical | GitHub advisory, release notes |
| ghcr.io/karakeep-app/karakeep (karakeep) | 0.33.2 | 3 | no fixed version named yet; v0.34.0; v0.34.1 | high | GitHub advisory, release notes |
| ghcr.io/sysadminsmedia/homebox (homebox) | 0.26.2 | 2 | v0.27.0; v0.27.1 | not given | release notes |
| ghcr.io/tandoorrecipes/recipes (tandoor) | 2.6.15 | 1 | 2.7.0 | not given | release notes |
| grafana/grafana (grafana) | 13.2.3 | 1 | v13.2.4 | not given | release notes |
| jellyfin/jellyfin (jellyfin) | 10.11.11 | 6 | 12.0 | critical | GitHub advisory |
| louislam/uptime-kuma (uptime-kuma) | 2.5.5 | 4 | 2.5.6; 2.5.7; 2.5.8; the range is unreadable — check by hand | medium | GitHub advisory, release notes |
| lscr.io/linuxserver/bookstack (bookstack) | 26.09.1 | 1 | v26.09.2 | not given | release notes |
| lscr.io/linuxserver/code-server (code-server) | 4.129.0 | 1 | v4.141.1 | not given | release notes |
| lukevella/rallly (rallly) | 4.15.3 | 5 | 4.15.4; v4.15.4; v4.15.5; v4.16.0; v4.16.2 | critical | GitHub advisory, release notes |
| outlinewiki/outline (outline) | 1.10.1 | 1 | v1.12.0 | not given | release notes |
| privatebin/pdo (privatebin) | 2.0.6 | 1 | 2.1.0 | not given | release notes |
| rommapp/romm (romm) | 5.3.1 | 2 | 5.4.0; 5.4.1 | not given | release notes |
| vikunja/vikunja (vikunja) | 2.6.0 | 2 | v2.7.0; v2.7.1 | not given | release notes |
142 notices on 30 pins.
documentation/audits/security-watch-2026-10-26/ci-dry.log
+764
View File
@@ -0,0 +1,764 @@
felhom-gates-runner-2(version:v0.6.1) received task 2427 of job watch, be triggered by event: workflow_dispatch
workflow prepared
evaluating expression 'success()'
expression 'success()' evaluated to 'true'
evaluating expression ''
expression '' evaluated to 'true'
⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
base=http://gitea.gitea-system.svc.cluster.local:3000/admin
git init -q . && git remote add origin $base/felhom.eu.git
git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
for r in felhom-controller app-catalog-felhom.eu; do
git init -q ../$r && git -C ../$r remote add origin $base/$r.git
git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
done
shell: bash --noprofile --norc -e -o pipefail {0}
::endgroup::
felhom.eu main at 1f62d629158c
felhom-controller at e01eb64b2591
app-catalog-felhom.eu at f61800aae945
::group::Run set -u
set -u
mkdir -p documentation/security-watch
mode="${MODE:-run}"
[ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
echo "mode: $mode"
case "$mode" in
test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
dry) extra="--no-mail" ; state=/tmp/state-dry.json
cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
run) extra="" ; state=documentation/security-watch/state.json ;;
*) echo "unknown mode $mode"; exit 2 ;;
esac
python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
--controller=../felhom-controller --json=/tmp/watch-results.json $extra
shell: bash --noprofile --norc -e -o pipefail {0}
env:
RESEND_API_KEY: ***
GH_ADVISORY_TOKEN:
MODE: dry
::endgroup::
mode: dry
/root/.cache/act/6ed0fc4eeecacefe/hostexecutor/scripts/security_watch.py:687: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
security watch 2026-10-26: 108 pins (11 box/build, 97 app); GitHub key ABSENT — apps' advisories in a 2-night rotation
ADVISORY box cloudflare/cloudflared 2026.10.3 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.4:VULN-176088 (fixed 2026.10.4)
ADVISORY box gtstef/filebrowser 1.5.6-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 32 more
ADVISORY box traefik v3.7.13 GHSA-hrpp-p4fc-wwf8 (fixed v3.7.16); GHSA-p8wx-ph99-xgcr (fixed v3.7.15); GHSA-fh26-gfpp-7xxx (fixed v3.7.14); GHSA-qvj7-gq9c-hp7q (fixed v3.7.14); … 11 more
ADVISORY app freikin/dawarich 1.15.3 release:Freika/dawarich@1.17.0 (fixed 1.17.0)
ADVISORY app ghcr.io/sysadminsmedia/homebox 0.26.2 release:sysadminsmedia/homebox@v0.27.1 (fixed v0.27.1); release:sysadminsmedia/homebox@v0.27.0 (fixed v0.27.0)
ADVISORY app ghcr.io/tandoorrecipes/recipes 2.6.15 release:TandoorRecipes/recipes@2.7.0 (fixed 2.7.0)
ADVISORY app grafana/grafana 13.2.3 release:grafana/grafana@v13.2.4 (fixed v13.2.4)
ADVISORY app lscr.io/linuxserver/bookstack 26.09.1 release:BookStackApp/BookStack@v26.09.2 (fixed v26.09.2)
ADVISORY app lscr.io/linuxserver/code-server 4.129.0 release:coder/code-server@v4.141.1 (fixed v4.141.1)
ADVISORY app outlinewiki/outline 1.10.1 release:outline/outline@v1.12.0 (fixed v1.12.0)
ADVISORY app privatebin/pdo 2.0.6 release:PrivateBin/PrivateBin@2.1.0 (fixed 2.1.0)
ADVISORY app rommapp/romm 5.3.1 release:rommapp/romm@5.4.1 (fixed 5.4.1); release:rommapp/romm@5.4.0 (fixed 5.4.0)
ADVISORY app vikunja/vikunja 2.6.0 release:go-vikunja/vikunja@v2.7.1 (fixed v2.7.1); release:go-vikunja/vikunja@v2.7.0 (fixed v2.7.0)
NOT CHECKED app codewithcj/sparkyfitness v0.17.3 GitHub API rate limit reached earlier tonight
NOT CHECKED app codewithcj/sparkyfitness_server v0.17.3 GitHub API rate limit reached earlier tonight
NOT CHECKED app crocodilestick/calibre-web-automated v4.0.8 GitHub API rate limit reached earlier tonight
NOT CHECKED app docmost/docmost 0.96.0 GitHub API rate limit reached earlier tonight
NOT CHECKED app f0rc3/gokapi v1.9.6 GitHub API rate limit reached earlier tonight
NOT CHECKED app fallenbagel/jellyseerr 2.7.3 GitHub API rate limit reached earlier tonight
NOT CHECKED app flomp/wanderer-db v0.20.0 GitHub API rate limit reached earlier tonight
NOT CHECKED app flomp/wanderer-web v0.20.0 GitHub API rate limit reached earlier tonight
NOT CHECKED app ghcr.io/advplyr/audiobookshelf 2.37.1 GitHub API rate limit (403)
NOT CHECKED app ghcr.io/alam00000/bentopdf v2.8.6 GitHub API rate limit (403)
NOT CHECKED app ghcr.io/cmintey/wishlist v0.67.1 GitHub API rate limit reached earlier tonight
NOT CHECKED app ghcr.io/gramps-project/grampsweb v25.6.0 GitHub API rate limit reached earlier tonight
NOT CHECKED app ghcr.io/grimmory-tools/grimmory v3.5.0 GitHub API rate limit reached earlier tonight
NOT CHECKED app ghcr.io/hargata/lubelogger v1.7.3 GitHub API rate limit reached earlier tonight
NOT CHECKED app ghcr.io/home-assistant/home-assistant 2026.9.4 GitHub API rate limit reached earlier tonight
NOT CHECKED app ghcr.io/immich-app/immich-machine-learning v3.2.4 GitHub API rate limit reached earlier tonight
NOT CHECKED app ghcr.io/immich-app/immich-server v3.2.4 GitHub API rate limit reached earlier tonight
NOT CHECKED app ghcr.io/karakeep-app/karakeep 0.33.2 GitHub API rate limit reached earlier tonight
NOT CHECKED app ghcr.io/kozea/radicale 3.8.1 GitHub API rate limit reached earlier tonight
NOT CHECKED app ghcr.io/seanmorley15/adventurelog-backend v0.13.0 GitHub API rate limit (403)
NOT CHECKED app jellyfin/jellyfin 10.11.11 GitHub API rate limit reached earlier tonight
NOT CHECKED app kimai/kimai2 2.67.0 GitHub API rate limit reached earlier tonight
NOT CHECKED app louislam/uptime-kuma 2.5.5 GitHub API rate limit reached earlier tonight
NOT CHECKED app lscr.io/linuxserver/grocy 4.7.1 GitHub API rate limit reached earlier tonight
NOT CHECKED app lscr.io/linuxserver/sonarr 4.0.20 GitHub API rate limit reached earlier tonight
NOT CHECKED app lukevella/rallly 4.15.3 GitHub API rate limit reached earlier tonight
NOT CHECKED app msdeluise/plant-it 0.10.0 GitHub API rate limit reached earlier tonight; Docker registry tags of msdeluise/plant-it: HTTP 401
NOT CHECKED app nextcloud 34.0.4-apache GitHub API rate limit reached earlier tonight; GitHub API rate limit reached earlier tonight
NOT CHECKED app onlyoffice/documentserver 9.4.0 GitHub API rate limit reached earlier tonight
NOT CHECKED app qbittorrentofficial/qbittorrent-nox 5.2.4-1 GitHub API rate limit reached earlier tonight
BEHIND app actualbudget/actual-server 26.9.0 newest 26.10.0
BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
BEHIND app ghcr.io/alexta69/metube 2026.09.29 newest 2026.10.25
BEHIND app ghcr.io/lukegus/termix 2.8.0 newest 2.9.2
BEHIND app ghcr.io/mealie-recipes/mealie v3.28.0 newest v3.29.0
BEHIND app ghcr.io/papra-hq/papra 26.6.2-rootless newest 26.7.1-rootless
BEHIND app ghost 6.67.0-alpine newest 6.72.0-alpine
BEHIND app glanceapp/glance v0.8.5 newest v0.8.7
BEHIND app gotson/komga 1.28.0 newest 1.29.1
BEHIND app n8nio/n8n 2.42.1 newest 2.45.4
BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
GAP buil alpine 3.24.2 newest 3.24.3
GAP buil alpine 3.24.2 newest 3.24.3
GAP buil debian 13.7-slim
GAP buil debian 13.7-slim
GAP app emby/embyserver 4.11.0.4 newest 4.11.0.10
GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
GAP app mariadb 12.3
GAP app mariadb 11.4 newest 11.8
GAP app mariadb 11.8
GAP app mariadb 12.3
GAP app mariadb 11.8
GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
GAP app postgis/postgis 16-3.5-alpine
GAP app postgis/postgis 17-3.5-alpine
GAP app postgres 18-alpine
GAP app postgres 17-alpine
GAP app postgres 18-alpine
GAP app postgres 18-alpine
GAP app postgres 18-alpine
GAP app postgres 18-alpine
GAP app postgres 18-alpine
GAP app postgres 17-alpine
GAP app postgres 16-alpine
GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
FLOATING app ghcr.io/claperco/claper 2.5
FLOATING app ghcr.io/thomiceli/opengist 1.15
FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
FLOATING app nzbgetcom/nzbget v26.3
FLOATING app redis 7.4-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app redis 7-alpine
FLOATING app wger/server 2.7
SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
CURRENT buil golang 1.27.3-trixie
CURRENT buil golang 1.27.3-alpine3.24
CURRENT buil restic 0.19.1
CURRENT app calcom/cal.com v6.2.0
CURRENT app deluan/navidrome 0.64.2
CURRENT app ghcr.io/diced/zipline 4.8.0
CURRENT app ghcr.io/gethomepage/homepage v1.13.2
CURRENT app ghcr.io/paperless-ngx/paperless-ngx 2.20.15
CURRENT app ghcr.io/seanmorley15/adventurelog-frontend v0.13.0
CURRENT app gitea/gitea 1.27.3
CURRENT app lscr.io/linuxserver/radarr 6.4.4
CURRENT app vaultwarden/server 1.37.4-alpine
COUNTS ADVISORY=13 BEHIND=12 CURRENT=12 FLOATING=14 GAP=25 NOT_CHECKED=30 SELF=2
REQUESTS api.github.com=8 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 ghcr.io=52 github.com=34 hub.docker.com=145 raw.githubusercontent.com=1 registry-1.docker.io=1
WOULD HAVE MAILED (seed): [Felhom security] cloudflared, filebrowser, traefik, dawarich … — 66 new advisories
The nightly security watch (felhom.eu R-1303) found a notice that affects a version we ship.
Box programs first.
cloudflare/cloudflared — feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3
What: 8 eMudhra certificates are compromised. Here's what you need to know
Our version: 2026.10.3 (controller infra; controller/internal/infra/upstream.txt CloudflaredImage)
Fixed in: read the notice
Severity: not given
Source: vendor notice (cloudflare-blog)
Link: https://blog.cloudflare.com/emudhra-certificate-compromise/
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
cloudflare/cloudflared — vulnnotes:cloudflared@2026.10.4:VULN-176088
What: - 2026-10-23 VULN-176088: Allowlist debug endpoints on the metrics server
Our version: 2026.10.3 (controller infra; controller/internal/infra/upstream.txt CloudflaredImage)
Fixed in: 2026.10.4
Severity: not given
Source: release notes (cloudflared)
Link: https://raw.githubusercontent.com/cloudflare/cloudflared/master/RELEASE_NOTES
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-26fh-r34c-qxh6
What: Moving or renaming a folder retargets public shares to the whole folder
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-26fh-r34c-qxh6
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-3846-gh75-gp3m
What: Public upload share AllowReplacements=false is bypassed by override=true (deny only checks unused action=override)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 1.5.7-stable, 2.0.8-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3846-gh75-gp3m
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-3j46-5w28-f8p2
What: Incomplete symlink-containment remediation: relocated archive symlink allows arbitrary host file write
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-3j46-5w28-f8p2
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-4fhx-8pf6-5gmr
What: Duplicate finder can show another user’s restricted file names from a shared cache
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: low
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4fhx-8pf6-5gmr
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-4v62-884x-2466
What: Read-only sources (`readOnly: true`) can be written and deleted through WebDAV, archive/unarchive and the OnlyOffice save callback
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4v62-884x-2466
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-4vrc-935w-xxq2
What: Per-path access DENY rule bypass via filesystem name aliases (case variant, Windows 8.3 short name, trailing-dot) — access rules evaluated before path canonicalization
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4vrc-935w-xxq2
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-4wmj-rq3c-m65v
What: Improper session revocation allows authentication bypass via revoked-JWT resurrection in `extractUserFromExpiredToken`
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= 2.0.1-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-4wmj-rq3c-m65v
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-55mw-cwg7-m8f5
What: `GET /public/api/media/metadata` returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.5-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-55mw-cwg7-m8f5
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-6gr6-5qpq-888p
What: Privilege Escalation: Restricted Custom API Token Can Be Upgraded to a Full-Permission Session Token via /api/auth/renew in FileBrowser Quantum
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.10-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-6gr6-5qpq-888p
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-8655-2ph3-q7q7
What: Authenticated Modify-only user can create new files through WebDAV PUT despite Create permission being disabled
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8655-2ph3-q7q7
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-8m35-wcjh-95q7
What: Logout Bypass via Alternate JWT Spelling
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= 2.0.1-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8m35-wcjh-95q7
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-9fcr-gm58-p839
What: Share directory-archive download skips per-user access rules, exposing admin-denied content to anonymous share visitors
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-9fcr-gm58-p839
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-9wm6-jcjh-3m8c
What: Stored XSS via Unsanitized DOCX Hyperlink in DocViewer
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >=2.0.1-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-9wm6-jcjh-3m8c
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-c7pj-xjp9-x4xp
What: Read-only users can overwrite files through PUT /api/resources
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.0-stable
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c7pj-xjp9-x4xp
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-c84q-q5g6-r47f
What: createUserDir: new accounts named `..` or `b..ob` are given the folder that holds every user's home, or another user's home (cross-user read and write)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.1-stable, 2.1.2-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c84q-q5g6-r47f
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-c9cr-w724-gqj3
What: Session tokens issued in the same second are identical, so a low-privilege user's session can resolve to another user, including an admin
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.1-stable
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-c9cr-w724-gqj3
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-cw65-p35p-633w
What: FileBrowser Quantum: file-upload / mkdir authorization uses the scope-relative path, bypassing per-user access-rule denials (write into a restricted directory)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= 2.0.0-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-cw65-p35p-633w
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-g2q5-r6ch-v25f
What: FileBrowser Quantum authenticated arbitrary file read via symlink following on the preview read path (incomplete fix of GHSA-mgqf-5mf5-prfj)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-g2q5-r6ch-v25f
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-gfgm-886h-6r47
What: Custom API token with no global caps inherits owner admin access
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.4-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-gfgm-886h-6r47
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-mgqf-5mf5-prfj
What: Symlink following escapes user scope allowing arbitrary file read outside the served directory
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= 2.0.1-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-p7x3-p5jj-9xfh
What: Incomplete remediation of GHSA-55mw-cwg7-m8f5: public media routes bypass share restrictions
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.0-stable, 2.0.10-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p7x3-p5jj-9xfh
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-p93p-v944-4p44
What: Unarchive writes into folders denied by access rules and overwrites files without modify permission
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p93p-v944-4p44
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-p9wm-f5jj-75pj
What: FileBrowser Quantum SSE EventRouter Concurrent Map Iteration/Write DoS
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-p9wm-f5jj-75pj
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-qqf3-2wvq-q4w9
What: Archive download follows symlinks out of source scope (arbitrary file read)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqf3-2wvq-q4w9
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-qv53-4557-m65h
What: Improper authorization in public upload endpoint allows anonymous bypass of er-folder DENY ACLs via Scope-Stripped path key
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= v2.0.0-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qv53-4557-m65h
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-qx86-4v5r-26g5
What: MFA bypass and account takeover via unauthenticated TOTP re-enrollment in FileBrowser Quantum (`/api/auth/otp/generate` + `/api/auth/otp/verify`)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 1.5.7-stable, 2.0.10-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qx86-4v5r-26g5
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-r744-4vm3-2px3
What: Passkey MFA factor can be wiped, overwritten or attacker-enrolled with only a session cookie, bypassing the password re-authentication enforced for TOTP and password changes
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-r744-4vm3-2px3
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-rmjp-pfrq-cc3v
What: Stored XSS in the File Size Analyzer tooltip (unescaped v-html) with a nonce-CSP bypass via an allowlisted CDN
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-rmjp-pfrq-cc3v
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-rqqq-wv83-rp74
What: Absolute Path Traversal Bypass in SanitizeUserPath allows authenticated arbitrary file read outside user scope
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= v2.0.1-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-rqqq-wv83-rp74
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-vvm6-jwrf-hgmg
What: Stored XSS via HTML Preview — `<script>` Whitelist + `allow-same-origin` Sandbox Escape
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.3-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvm6-jwrf-hgmg
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-wfjp-qhvc-69wp
What: Share path re-point allows scope escape (arbitrary read/write across the source root)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= 2.0.0-beta
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-wfjp-qhvc-69wp
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-wjp8-g49g-xrhx
What: Failed-login lockout bypass: client-controlled leftmost X-Forwarded-For is trusted, and the documented nginx config forwards it
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.1.0-stable, 2.1.3-beta
Severity: low
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-wjp8-g49g-xrhx
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-wxj5-g3qp-g732
What: Cross-source view-grant confusion: a public share's view token lets an authenticated user with view=false/download=false read files in their own source scope (/api/resources/view)
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: 2.0.2-stable, 2.1.3-beta
Severity: medium
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-wxj5-g3qp-g732
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — GHSA-x79q-5hqm-x839
What: Share authorization gaps let read-only users delete files
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: >= 2.0.0-stable
Severity: high
Source: GitHub advisory
Link: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-x79q-5hqm-x839
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — release:gtsteffaniak/filebrowser@v1.5.7-stable
What: [High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second factor using only the account password; res
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: v1.5.7-stable
Severity: not given
Source: release notes
Link: https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.7-stable
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
gtstef/filebrowser — release:gtsteffaniak/filebrowser@v1.5.8-stable
What: [High] TOTP re-enrollment via POST /api/auth/otp/generate and POST /api/auth/otp/verify no longer allows anonymous callers to replace an existing second factor using only the account password; res
Our version: 1.5.6-stable (controller infra; controller/internal/infra/upstream.txt FileBrowserImage)
Fixed in: v1.5.8-stable
Severity: not given
Source: release notes
Link: https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.8-stable
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-28hp-c82p-8vqj
What: Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.15
Severity: low
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-28hp-c82p-8vqj
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-53qr-784g-cj35
What: FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-cw35-4q88-3rmp
What: Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-cw35-4q88-3rmp
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-fh26-gfpp-7xxx
What: snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-fh26-gfpp-7xxx
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-hrpp-p4fc-wwf8
What: ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.16
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-mhjw-hmjv-p99x
What: Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: medium
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-mwrr-6hp4-pxr6
What: Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-mwrr-6hp4-pxr6
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-p8wx-ph99-xgcr
What: ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.15
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-qm9f-w54v-q2qh
What: Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-qm9f-w54v-q2qh
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-qvj7-gq9c-hp7q
What: Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-qvj7-gq9c-hp7q
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-rv2h-qh7j-xrjw
What: Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-rv2h-qh7j-xrjw
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — GHSA-ww7c-q3mv-xx22
What: Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.15
Severity: high
Source: GitHub advisory
Link: https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — release:traefik/traefik@v3.7.14
What: Advisory GHSA-53qr-784g-cj35
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.14
Severity: not given
Source: release notes
Link: https://github.com/traefik/traefik/releases/tag/v3.7.14
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — release:traefik/traefik@v3.7.15
What: Advisory GHSA-p8wx-ph99-xgcr
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.15
Severity: not given
Source: release notes
Link: https://github.com/traefik/traefik/releases/tag/v3.7.15
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
traefik — release:traefik/traefik@v3.7.16
What: Advisory GHSA-hrpp-p4fc-wwf8
Our version: v3.7.13 (controller infra; controller/internal/infra/upstream.txt TraefikImage)
Fixed in: v3.7.16
Severity: not given
Source: release notes
Link: https://github.com/traefik/traefik/releases/tag/v3.7.16
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
freikin/dawarich — release:Freika/dawarich@1.17.0
What: js 20 package, which no longer receives upstream security fixes
Our version: 1.15.3 (dawarich; templates/dawarich/.felhom.yml upstream: freikin/dawarich)
Fixed in: 1.17.0
Severity: not given
Source: release notes
Link: https://github.com/Freika/dawarich/releases/tag/1.17.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/sysadminsmedia/homebox — release:sysadminsmedia/homebox@v0.27.0
What: Security Issues Patched
Our version: 0.26.2 (homebox; templates/homebox/.felhom.yml upstream: ghcr.io/sysadminsmedia/homebox)
Fixed in: v0.27.0
Severity: not given
Source: release notes
Link: https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/sysadminsmedia/homebox — release:sysadminsmedia/homebox@v0.27.1
What: Warning This release is a security release to patch a NodeJS upstream vulnerability
Our version: 0.26.2 (homebox; templates/homebox/.felhom.yml upstream: ghcr.io/sysadminsmedia/homebox)
Fixed in: v0.27.1
Severity: not given
Source: release notes
Link: https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.1
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
ghcr.io/tandoorrecipes/recipes — release:TandoorRecipes/recipes@2.7.0
What: fixed shopping list bulk API endpoint accepted IDs from foreign spaces GHSA-5p9v-743w-79h3
Our version: 2.6.15 (tandoor; templates/tandoor/.felhom.yml upstream: ghcr.io/tandoorrecipes/recipes)
Fixed in: 2.7.0
Severity: not given
Source: release notes
Link: https://github.com/TandoorRecipes/recipes/releases/tag/2.7.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
grafana/grafana — release:grafana/grafana@v13.2.4
What: Security: Fix CVE-2026-15577
Our version: 13.2.3 (grafana; templates/grafana/.felhom.yml upstream: grafana/grafana)
Fixed in: v13.2.4
Severity: not given
Source: release notes
Link: https://github.com/grafana/grafana/releases/tag/v13.2.4
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
lscr.io/linuxserver/bookstack — release:BookStackApp/BookStack@v26.09.2
What: Security Release
Our version: 26.09.1 (bookstack; templates/bookstack/.felhom.yml upstream: lscr.io/linuxserver/bookstack)
Fixed in: v26.09.2
Severity: not given
Source: release notes
Link: https://github.com/BookStackApp/BookStack/releases/tag/v26.09.2
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
lscr.io/linuxserver/code-server — release:coder/code-server@v4.141.1
What: Brotli decoder ( CVE-2026-111497 )
Our version: 4.129.0 (code-server; templates/code-server/.felhom.yml upstream: lscr.io/linuxserver/code-server)
Fixed in: v4.141.1
Severity: not given
Source: release notes
Link: https://github.com/coder/code-server/releases/tag/v4.141.1
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
outlinewiki/outline — release:outline/outline@v1.12.0
What: 1 which fixes multiple recently disclosed vulnerabilities
Our version: 1.10.1 (outline; templates/outline/.felhom.yml upstream: outlinewiki/outline)
Fixed in: v1.12.0
Severity: not given
Source: release notes
Link: https://github.com/outline/outline/releases/tag/v1.12.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
privatebin/pdo — release:PrivateBin/PrivateBin@2.1.0
What: More details on this issue can be found in the security advisory:
Our version: 2.0.6 (privatebin; templates/privatebin/.felhom.yml upstream: privatebin/pdo)
Fixed in: 2.1.0
Severity: not given
Source: release notes
Link: https://github.com/PrivateBin/PrivateBin/releases/tag/2.1.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
rommapp/romm — release:rommapp/romm@5.4.0
What: 0 [security] by @renovate [bot] in #4966
Our version: 5.3.1 (romm; templates/romm/.felhom.yml upstream: rommapp/romm)
Fixed in: 5.4.0
Severity: not given
Source: release notes
Link: https://github.com/rommapp/romm/releases/tag/5.4.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
rommapp/romm — release:rommapp/romm@5.4.1
What: While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible
Our version: 5.3.1 (romm; templates/romm/.felhom.yml upstream: rommapp/romm)
Fixed in: 5.4.1
Severity: not given
Source: release notes
Link: https://github.com/rommapp/romm/releases/tag/5.4.1
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
vikunja/vikunja — release:go-vikunja/vikunja@v2.7.0
What: 🔒 Six security fixes
Our version: 2.6.0 (vikunja; templates/vikunja/.felhom.yml upstream: vikunja/vikunja)
Fixed in: v2.7.0
Severity: not given
Source: release notes
Link: https://github.com/go-vikunja/vikunja/releases/tag/v2.7.0
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
vikunja/vikunja — release:go-vikunja/vikunja@v2.7.1
What: 🔒 A whopping 41(!) security fixes from community reports and an automated audit, reworked attachment previews, signed Docker images and a pile of bugfixes
Our version: 2.6.0 (vikunja; templates/vikunja/.felhom.yml upstream: vikunja/vikunja)
Fixed in: v2.7.1
Severity: not given
Source: release notes
Link: https://github.com/go-vikunja/vikunja/releases/tag/v2.7.1
Next: the security-fix lane (B23) — capability map B23; for a box program, a controller release
A notice is mailed once, and again every 7 days while it stays open. Night of 2026-10-26.
MAIL (not sent, --no-mail): [Felhom security] the watch's memory was missing — re-seeded
STATE written: /tmp/state-dry.json (66 known advisories)
Cleaning up container for job watch
🏁 Job succeeded
documentation/audits/security-watch-2026-10-26/ci-seed.log
+1478
View File
File diff suppressed because it is too large. Load diff
documentation/audits/security-watch-2026-10-26/ci-testmail.log
+52
View File
@@ -0,0 +1,52 @@
felhom-gates-runner(version:v0.6.1) received task 2429 of job watch, be triggered by event: workflow_dispatch
workflow prepared
evaluating expression 'success()'
expression 'success()' evaluated to 'true'
evaluating expression ''
expression '' evaluated to 'true'
⭐ Run Main Fetch main (latest, for the memory) and the two sibling repos
Wrote command \n\necho "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"\nbase=http://gitea.gitea-system.svc.cluster.local:3000/admin\ngit init -q . && git remote add origin $base/felhom.eu.git\ngit fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD\necho "felhom.eu main at $(git rev-parse --short=12 HEAD)"\nfor r in felhom-controller app-catalog-felhom.eu; do\n git init -q ../$r && git -C ../$r remote add origin $base/$r.git\n git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD\n echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"\ndone\n\n\n to 'workflow/0.sh'
::group::Run echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
echo "WATCH_STARTED_AT=$(date +%s)" >> "$GITHUB_ENV"
base=http://gitea.gitea-system.svc.cluster.local:3000/admin
git init -q . && git remote add origin $base/felhom.eu.git
git fetch -q --depth 1 origin main && git checkout -q -B main FETCH_HEAD
echo "felhom.eu main at $(git rev-parse --short=12 HEAD)"
for r in felhom-controller app-catalog-felhom.eu; do
git init -q ../$r && git -C ../$r remote add origin $base/$r.git
git -C ../$r fetch -q --depth 1 origin main && git -C ../$r checkout -q FETCH_HEAD
echo "$r at $(git -C ../$r rev-parse --short=12 HEAD)"
done
shell: bash --noprofile --norc -e -o pipefail {0}
::endgroup::
felhom.eu main at 6ee23a3b8f90
felhom-controller at e01eb64b2591
app-catalog-felhom.eu at f61800aae945
::group::Run set -u
set -u
mkdir -p documentation/security-watch
mode="${MODE:-run}"
[ "${GITHUB_EVENT_NAME:-}" = "schedule" ] && mode=run
echo "mode: $mode"
case "$mode" in
test-mail) python3 scripts/security_watch.py --test-mail; exit $? ;;
dry) extra="--no-mail" ; state=/tmp/state-dry.json
cp documentation/security-watch/state.json "$state" 2>/dev/null || true ;;
seed) extra="--seed" ; state=documentation/security-watch/state.json ;;
run) extra="" ; state=documentation/security-watch/state.json ;;
*) echo "unknown mode $mode"; exit 2 ;;
esac
python3 scripts/security_watch.py --state="$state" --catalog=../app-catalog-felhom.eu \
--controller=../felhom-controller --json=/tmp/watch-results.json $extra
shell: bash --noprofile --norc -e -o pipefail {0}
env:
RESEND_API_KEY: ***
GH_ADVISORY_TOKEN:
MODE: test-mail
::endgroup::
mode: test-mail
/root/.cache/act/1d095cc34caf5db5/hostexecutor/scripts/security_watch.py:715: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
TEST-MAIL RESEND-ACCEPTED id=01a17a5d-b46f-7a8e-b0eb-4e89c01c7354 subject=[Felhom security] TEST — not a real advisory: TEST-program — 1 new advisory
Cleaning up container for job watch
🏁 Job succeeded
documentation/backlog/OPEN-ITEMS.md
+8 -3
View File
@@ -124,11 +124,13 @@ stopping line that lies.
| **R-494** | Install & onboarding | P4 | **NARROWED 2026-09-14 by operator ruling → [P3-LOW] the hub COULD create the tunnel at customer creation, for a domain already on Cloudflare. Not blocking: every customer has their own domain and the operator creates the tunnel per day-0 A.1 (`architecture/01-topology-and-trust.md`).** *Original finding, kept:* **[P1-HIGH] A new customer's dashboard has NO reachable address unless the operator hand-makes a Cloudflare tunnel — the link in the setup-code mail is dead.** MEASURED 2026-09-14 on a fresh install from the public ISO (drill intervention **I1**): the claim mail points at `https://felhom.drill0242.felhom.eu`; that name has **no A and no AAAA** record (`dig @1.1.1.1`, control `felhom.enkisfelhom.hu` resolves); the hub has **no tunnel- or DNS-creation code** (`hub/internal/cloudflare/` holds only geo-rule removal; `cf_tunnel_token` is a pasted, optional form field, `configs.go:1478`) — day-0 runbook A.1 makes it a manual Cloudflare-dashboard step that nothing on the customer-create page asks for; the box's own split-horizon resolver on the appliance LAN IP answered `google.com` but not the dashboard name at 13:27:39Z; the agent applied the record at **13:27:44Z** (`lanresolver: applied split-horizon record … ip=192.168.0.158`, 3 m 46 s after the controller started), so the box CAN answer the name — **but only to a device that uses the box as its DNS server, and no document, screen or mail tells a household to do that**; the router and the installer-offered DNS answer nothing. The page was reachable only at the guest's LAN address with the name forced (`curl --resolve …:443:192.168.0.158`). **A volunteer could not have done that.** **What it needs:** an operator ruling — the hub creates the tunnel and DNS at customer creation, or the product gives a household a LAN address that works with no DNS change. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: operator-side automation; the operator creates the tunnel by hand per the day-0 runbook.** | — | — | CC |
| **R-504** | Install & onboarding | P4 | **[P3-LOW] `iso.felhom.eu` cannot show an index page on its own — its root returns 404, and the download page lives on the website instead.** MEASURED 2026-09-14: `https://iso.felhom.eu/` and `/index.html` → 404; only named objects answer. The host is an R2 bucket behind a custom domain; whether R2 would serve an uploaded `index.html` at `/` was **not measured** (uploading anything to the public bucket is a publication). The ISO v1.27.0 task puts the Hungarian download page at `felhom.eu/letoltes` (published with the ISO, after the operator's yes). **Remaining:** a redirect from `iso.felhom.eu/` to that page needs a Cloudflare rule the session has no credential for. | **WAITING-ON-OPERATOR — rank P3-LOW; owner: operator (Cloudflare rule)** **Re-ranked 2026-10-03: P3→P4: households are sent to the website's download page; the bare address is cosmetic.** | — | — | operator |
## Apps & catalog — 17 rows (P3 7, P4 10)
## Apps & catalog — 19 rows (P2 1, P3 8, P4 10)
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|---|---|---|---|---|---|---|---|
| **R-1306** | Apps & catalog | P2 | **The first security-watch run: 27 catalog pins carry published notices that affect the version we pin** (89 notices; the list with our version and the fixed versions: `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md`). Several fix only in a NEW major (Jellyfin 10.11.11 → 12.0; Gokapi 1.9.6 → 2.x; Seerr 2.7.3 → 3.x); some name no fix yet (SparkyFitness); some are release notes naming a CVE (Grafana, BookStack, PrivateBin …). The seed mailed none of them (R-1303). | OPEN — filed 2026-10-26 | the operator's order of triage | worst first through the security-fix lane (B23): read each notice against how the app is deployed, then a ladder step or a re-pin | CC |
| **R-1091** | Apps & catalog | P3 | **Catalog copy that is wrong or stale at the pinned tag, found writing the guides — each needs an operator word or a live check, so none was changed tonight.** From source at each app's tag (evidence per app in `audits/app-guides-2026-10-15/B/`): (1) and (2) **DONE 2026-10-16** (operator decision D12: reword): calcom's use case now names Apple Calendar or a CalDAV calendar instead of Google/Outlook, and bentopdf's tagline and use case say the browser does the work and the file stays on the device (catalog CHANGELOG 2026-10-16); (3) **sabnzbd**, **nzbget** use_cases say Radarr/Sonarr/Jellyseerr hand them jobs — the box wires only qBittorrent and Transmission (`mediawire.go`), and a hand link needs a path mapping; (4) **onlyoffice** first_steps 3–4 tell the household to wire Nextcloud by hand — the integration toggle does it (`internal/integrations/onlyoffice_nextcloud.go`); (5) **glance**, **homepage** first_steps send the household into config files in a Docker volume no household tool reaches; (6) **lubelogger** starts with only the „Dashboard" tab and in miles (shipped `appsettings.json`), so first step 3 cannot be done as written; (7) **home-assistant** first_steps promise auto-discovered devices — the app runs on a Docker bridge, where mDNS/SSDP were measured deaf (spike R-6); (8) **homebox** and **gitea** `add_people` name menus that moved or read differently at the tag; **bookstack** `default_creds` still says `admin@admin.com / password`, which after_install replaces; **dawarich** names the API key's page „Settings" (source suggests the account page); **code-server** says „install your tools" with no sudo; **komga** names the discontinued Tachiyomi; **seerr** `docs_url` points at Overseerr; **wanderer**'s comment still says it cannot close sign-up (R-714 is fixed in the same file); (9) **nzbget** and **grafana** deploy-field descriptions say the password can be changed later — nzbget re-applies its env password at every start and grafana ignores the field after first start (R-1086 is the qBittorrent/Transmission side). | OPEN — filed 2026-10-15 | — | Live-check (5)–(7) and (9) on 9202; fix (3), (4), (8) as copy with the freeze re-admitted; re-run the guide label check for any app whose copy moves | CC |
| **R-1308** | Apps & catalog | P3 | **14 catalog pins use a floating tag** (`redis:7-alpine`, `postgres:16-…`, `mariadb:12.3`, `nginx:…`): there is no exact version to match a notice's range against, so the security watch (R-1303) lists them FLOATING and matches nothing. `audits/security-watch-2026-10-26/ci-seed.log` (FLOATING) | OPEN — filed 2026-10-26 | — | pin the sidecars to exact versions where the engine allows (the image-pins gate today accepts a major tag) | CC |
| **R-1092** | Apps & catalog | P4 | **Three apps show no guide: plant-it and home-assistant carry one HIDDEN (`checked_version: ""`), emby has none.** plant-it: `lifecycle: abandoned`, and its pinned image does not exist upstream, so there is no screen to check labels against. home-assistant: its frontend follows the browser language and the Hungarian strings are fetched at build time, not kept in git, so the Hungarian labels cannot be checked against source (the draft is written; the shipped frontend in the image could check them). emby: its server's web UI is in no public source at 4.11.0.4. Evidence: `audits/app-guides-2026-10-15/B/`. The other 62 templates show a checked guide (controller ≥ 0.315.0). | OPEN — filed 2026-10-15 | — | home-assistant: check the Hungarian labels against the frontend files in the pinned image (read-only, on a box running it), then set checked_version; emby: label-check against the image's own web files the same way; plant-it: nothing while abandoned | CC |
| **R-676** | Apps & catalog | P3 | **[P3-LOW] Watch: immich's first start restarted 12 times — decision 28's crash-loop stop (6 in 10 min) would stop it.** From the 2026-09-17 chaos night (DB connection dropped during the first-start geocoding import on a 6 GB guest; it did not recover that night). No healthy app in any drill evidence restarts on a first start (1831 samples, 40 live containers), so the threshold stands; this row exists so the first immich install under v0.269.x is watched. `audits/night-2026-09-24/A3/40-first-start-restarts.txt` **2026-09-25 night (read from source, v0.271.0): a DEPLOY's first start is NOT covered by decision 28's suppression** — `Deploying` clears when `compose up -d` returns (`deploy.go` "Clear deploying flag"), and `ObserveUnhealthy` then samples the app; an automatic update's step, verify and undo ARE covered (`Updating`, pinned by `TestD28_NoCrashLoopStopDuringAnAutomaticStep`). So a first start that restarts ≥ 6 times in 10 min is stopped — which R-676 already accepts for a broken first start; a healthy slow first start would be stopped too. **-- 2026-09-30: the first-start restarts are explained.** immich's first-start geodata import OOM-kills its database at 512M on a guest with no swap (R-732, measured: 61–104 kills); the 2026-09-17 chaos-night case (DB connection dropped during the import on a 6 GB guest) fits it. Fixed in the catalog (`56c4888`, 768M). The watch itself (decision 28 on a DEPLOY's first start) is unchanged. | **OPEN — P3; owner: CC (watch)** | — | — | CC |
| **R-1028** | Apps & catalog | P3 | **Plex's claim code can run out during the install, and the box cannot recover it.** plex.tv's code lives 4 minutes from the moment the household copies it; the clock covers the wizard, the image pull (`plexinc/pms-docker` is 351 MB, measured) and the first start. Plex reads `PLEX_CLAIM` only on its first run, and the field is `locked_after_deploy` — so a late code leaves an unclaimed server and the only way back is remove + install again. Reported by the operator during the 2026-10-14 test; on Tester 1's line the pull+start took 8.5 s and the claim worked (`audits/media-all-drives-2026-10-14/``G-auth/G3-plex-claim.txt`), so it bites on a slow line or a slow hand. **K6, 2026-10-14 night (`audits/media-drive-events-2026-10-14/``K6-1-unclaimed-plex.txt`):** an unclaimed Plex starts with no code at all, and `POST /myplex/claim?token=` on the RUNNING server reaches plex.tv (a wrong code → 500 after plex.tv's 401). So the box can pull + start first and ask for the code after: no race. A real claim needs the household's code — the morning step on the throwaway `plex-k6` on Tester 1. Narrowed 2026-10-14 night. **PROVEN 2026-10-15 morning (`K6-2-claim-after-start.txt`):** the operator's real code, given to the RUNNING unclaimed `plex-k6` → 200, `claimed` 0→1, `PlexOnlineToken` written, and the open door closed (no token → 401). `ADVERTISE_IP` was unset and the claim did not need it; whether clients find the server without it was not measurable (the throwaway had no published port). **BUILT 2026-10-15 (v0.313.0):** `after_start` field — not asked at install; the Plex page asks for the code once Plex runs and claims the running server; the gate opens only when Plex says claimed. Proven up to the code on 9201 (G5). | **NARROWED** — the dashboard claim with a real code is the last step | a household Plex code | Claim through the Plex page with a real code (G5c); then close | CC |
@@ -231,19 +233,21 @@ stopping line that lies.
| **R-1275** | Storage & devices | P4 | **An English household sees the drive names in Hungarian** on the install page (and wherever a storage label shows): „Belső tárhely — 52.0 GB free (default)”, „Külső tárhely (hdd_1)” (catalog sweep 2026-10-24, `audits/catalog-sweep-2026-10-24/navidrome/page-install-en.txt`). The label is stored once, in Hungarian, when the drive is found (`felhom-controller/controller/internal/settings/settings.go` `InferStorageLabel`); a household may rename it. | OPEN | — | Render a label that still equals the inferred default in the reader's language; a test per language | CC |
| **R-1276** | Storage & devices | P4 | **„Remove with data” leaves the app's empty parent folder** (`<drive>/appdata/<app>`) when the template binds a subfolder: Grimmory, RomM, Paperless-ngx (catalog sweep 2026-10-24; 4 KB each; the bound folders were removed). Harmless (empty, not counted as old data), untidy for a household that browses the drive. | OPEN | — | Remove the parent when it is empty after the bound folders go; a test | CC |
## Security & access — 26 rows (P1 2, P2 4, P3 14, P4 6)
## Security & access — 29 rows (P1 2, P2 5, P3 15, P4 7)
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|---|---|---|---|---|---|---|---|
| **R-1241** | Security & access | P1 | **2026-10-24: the Felhom half is DONE** — hub 0.168.0 deployed (the tokens sealed; every copy leaving the volume is clean, the live file's old bytes accepted by the operator, R-975 closed), the hub volume out of the Longhorn backup (D40, R-1243 VERIFY), the two old plain copies deleted by the operator. **What stays here is the homelab half:** the open NFS export and Longhorn's login (the homelab session). **A hacked app pod on DooPlex can read the hub's nightly database copies — with every customer's unsealed Cloudflare, tunnel and git token (R-975) — through the Longhorn NFS export, and by a published file-handle escape the operator signing keys on the same disk: whoever breaks one homelab app can take over the boxes' tunnels and sign agent updates.** MEASURED 2026-10-23 (Plex2Shell impact audit, `audits/plex2shell-felhom-impact-2026-10-23/`): export `/mnt/5_hdd/backup/longhorn-pvc` rw, `no_root_squash`, `no_subtree_check`, a sub-directory of sda1, which also holds `/mnt/5_hdd/felhom.eu/felhom-op-*` (no passphrase, R-924); `secure` is void in pods (containerd sets `ip_unprivileged_port_start=0`; a uid-1000 probe with no capabilities bound port 700); the four `felhom-system` volumes have `encrypted=false`; Longhorn's API on :9500 answers any pod with no login (backups, targets, volumes). In the Plex2Shell window neither door was used — verdict NOT REACHED (nfsd accepted 0 new connections 10-10 → 10-23, positive control; no off-schedule Longhorn backup or volume). 2026-10-23 ~15:18Z, operator yes: the export was narrowed from `*` to `10.42.0.0/16` — the home network and the tailnet are closed, pods are not (Longhorn connects from its pod address). Not exercised: the escape itself (Tier-2 machine). | OPEN | the homelab session (DooPlex host + cluster); the operator (R-924) | Homelab: a NetworkPolicy so only `longhorn-system` reaches :2049/:111 and :9500, or the backup store on its own filesystem. Felhom: R-975 sealed in hub 0.168.0 (deploy pending); the hub's plain Longhorn copies → R-1243; a passphrase on the signing keys (R-924) | operator |
| **R-1303** | Security & access | P2 | **Nobody watches the security notices of what we ship.** The box's own programs and the 65 catalog apps are checked only by the monthly re-test, by hand, and only for „a newer version exists"; Cloudflare's eMudhra notice (R-1300) reached us by mail. Building: a nightly CI watch (GitHub per-repo advisories, the Cloudflare blog feed and cloudflared's `VULN-` notes, OSV for the Go builders, release feeds, registry tags) — ADVISORY mails that night, BEHIND weekly, a source down two nights mails. Spike: `audits/security-watch-2026-10-26/SPIKE.md` | OPEN — filed 2026-10-26, building | the GitHub key (operator said yes 2026-10-26; secret `GH_ADVISORY_TOKEN`) for the full nightly read | build, live run, test mail | CC |
| **R-1303** | Security & access | P2 | **Nobody watched the security notices of what we ship** — now a nightly CI watch (`scripts/security_watch.py`, 03:40 UTC; 108 pins: 11 box/build, 97 app): ADVISORY mails that night, BEHIND weekly, a source down two nights mails. BUILT and live-proven 2026-10-26: the test mail reached the mailbox (CI job 2407); the seed run (job 2408) recorded 142 open notices on 30 pins without mailing and committed its memory itself. Spike: `audits/security-watch-2026-10-26/SPIKE.md`; gaps: R-1307, R-1308, R-1309 | OPEN — built; closes after a week of nightly runs with the key (watch the Monday summary and one real ADVISORY mail) | the GitHub key: operator said yes 2026-10-26; secret `GH_ADVISORY_TOKEN` (store and CI) — without it the apps' advisory lists are read every second night | read the first nights' logs; switch to the key when it exists | CC |
| **R-1139** | Security & access | P2 | **Tester 2's break-glass root password was not rotated with the others (R-954, operator decision D1 = A, 2026-10-17): the box has been offline since 2026-10-04.** demo-hp, Tester 1 and demo-felhom were rotated and proven on 2026-10-17 (`audits/agent-allowlist-rotation-2026-10-17/P3/`). | OPEN — filed 2026-10-17 **2026-10-22: closes when Tester 2 is reinstalled (operator ruling 2026-10-22 14:11 — a fresh install sets and vaults a new console password).** | Tester 2 reporting again | When it reports: the installer's step 4b alone (`P3/rotate-step4b.sh` shape), then the vaulted value logs in (PVE API 200) and the old one is refused | CC |
| **R-1305** | Security & access | P2 | **The file manager on every box (FileBrowser Quantum 1.5.6-stable) is inside 36 published notices; 2 are fixed in our own channel (1.5.7-stable)** — GHSA-qx86-4v5r-26g5 (high: with the victim's password, an anonymous request re-enrolls TOTP and skips the second factor; our households have no second factor there, so low for us) and GHSA-3846-gh75-gp3m (medium: a public upload share replaces files). Most others name fixes only on the 2.x line. `files.<domain>` is public through the tunnel (behind the controller's forwardAuth, password sign-in on). Found by the first security-watch run (R-1303). `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md` | OPEN — filed 2026-10-26 | a controller release | raise `FileBrowserImage` to 1.5.7-stable in the next controller release; triage the 34 others against 1.5.x (which apply to the stable line) | CC |
| **R-1304** | Security & access | P3 | **traefik v3.7.13 (our pin) is inside 12 advisories of October 2026, fixed in v3.7.14–v3.7.16** (GHSA-fh26-gfpp-7xxx snicheck, GHSA-hrpp-p4fc-wwf8 ForwardAuth pool, GHSA-53qr-784g-cj35 FastProxy, and nine on the Kubernetes ingress-nginx provider or NTLM/Negotiate backends). Triage from our config: docker + file providers only, no FastProxy, no per-router TLS options, no NTLM backend; ForwardAuth goes to the controller — none seem to apply. Found by the security-watch spike (R-1303). `audits/security-watch-2026-10-26/raw/repoadv-traefik_traefik.txt` | OPEN — filed 2026-10-26 | a controller release | raise `TraefikImage` to ≥ v3.7.16 in the next controller release from `main`, with the release notes read for breaking changes | CC |
| **R-1042** | Security & access | P3 | **The boxes' Cloudflare keys cannot change zone settings, so Cloudflare's own „Always Use HTTPS” cannot be switched on.** Measured 2026-10-14 on all three zones (`audits/https-only-2026-10-14/``1A-1-zones-and-keys.txt`): each `cf_api_token` is valid and sees only its own zone, but GET/PATCH `settings/always_use_https`, `ssl`, `security_header` answer 403; the redirect and transform rule phases too. The https-only fix therefore lives on the box (decision 246). A second layer at Cloudflare needs „Zone Settings: Edit” (and, for headers, „Transform Rules”) added to each customer's key — the hub's zone-reach check stays. | **WAITING-ON-OPERATOR** — filed 2026-10-14 | a key permission only the operator can grant | Optional: widen each customer key, then switch „Always Use HTTPS” on per zone | operator |
| **R-1242** | Security & access | P3 | **The demo NAS export `/mnt/5_hdd/felhom-data` → 192.168.0.162 (demo-felhom) is a sub-directory of DooPlex's sda1 with `no_subtree_check`, so a compromised demo-felhom host could walk the whole disk as uid 101000 and read every world-readable file there (the GPG secrets exports are 0644, every repo, the public keys).** Measured 2026-10-23 (`audits/plex2shell-felhom-impact-2026-10-23/` Part 1; `exportfs -v`: `all_squash,anonuid=101000`). 0600 files (the signing keys) stay out of reach. Not exercised. | OPEN | a DooPlex host change (fence) | Give the demo share its own filesystem, or `subtree_check`; or remove other-read from `/mnt/5_hdd/backup/secrets/exports` | operator |
| **R-1104** | Security & access | P3 | **Check https-only on Tester 2 when it reports again.** R-1033 (plain http on every public name) is closed on the three boxes that report (35 names → 301, 2026-10-16). Tester 2 (`sajatfelhom.hu`) has been off since 2026-10-04 on controller 0.292.0; its addresses answer Cloudflare 530 (tunnel down), so nothing is served in plain http while it is off. When it comes back it takes the floor (≥ 0.312.0 carries the redirect). | OPEN — filed 2026-10-16 | Tester 2 reporting again | Run `scripts/https_only_check.py` with Tester 2 in it; close | CC |
| **R-1141** | Security & access | P3 | **`felhom-host-install --rotate-recovery` exists only as part of a full installer re-run, which also reinstalls the vouched agent and the root files.** On a box running a newer agent than the vouched one (demo-hp on the candidate, 2026-10-17) it would move the agent back; on a household box it is a much larger act than a password change. The 2026-10-17 rotation therefore ran the installer's own `step_break_glass` ALONE (`audits/agent-allowlist-rotation-2026-10-17/P3/`). | **NARROWED 2026-10-18 — built on `main`, not published.** `felhom-host-install.sh --rotate-recovery-only` runs step 4b alone (felhom.eu `7d64038f`): reads the hub, host id and host key from the agent config, refuses byo and every other mode flag, asks the hub's `/healthz` before the password changes, never touches the agent or root files. The default install path is unchanged in behaviour (harness verdicts and 9 transcripts identical old vs new; demo-hp `--preflight-only` identical; `--rotate-recovery-only --dry-run` on demo-hp changed nothing). `step_break_glass` moved, byte-identical, ahead of the argument parse. `break-glass.md` §5 points at it. Publishes only with the next `installer-v…` tag. | the next installer tag | Cut the next `installer-v…` tag (with the other untagged installer changes); close | CC |
| **R-1258** | Security & access | P3 | **ep0's iperf3 line-test server takes any tunnel peer's test: one box (root on its host) can keep it busy for the fleet or ask a long reverse test that fills ep0's uplink.** Found 2026-10-24 (SEC-2 X2): `felhom.eu/scripts/ep0-iperf3/felhom-iperf3.service:17` — no authorized users, no server-side duration or rate cap; one client at a time (`felhom-agent/internal/linetest/iperf.go:263-264` → `busy`; 6 tries a day). Static (no ep0 change in this run). | OPEN | — | per-box iperf3 users or server-side caps, tried on a scratch VM first | CC |
| **R-1307** | Security & access | P3 | **Packages inside our own images are not watched** — the Debian packages of the controller image, the Alpine packages of the hub and Samba images (Samba's version is whatever Alpine 3.24 ships). The security watch (R-1303) reads only the base image's point release (BEHIND); Debian's DSAs and Alpine's secdb are not read. `audits/security-watch-2026-10-26/SPIKE.md` „cannot see" | OPEN — filed 2026-10-26 | — | add Alpine secdb (machine-readable JSON per release) and Debian's tracker for the packages the images install, or a scanner run on the built images in CI | CC |
| **R-955** | Security & access | P4 | **The cross-box check of the hub API is done in source and tests but not fully proven: if a later check masks a missing id check, a box's key could read or change another box's hub record without any test noticing.** Read 2026-10-12: every box-facing `/api/v1` route takes the box from its own key or refuses a different id; 14 routes already had a refusal test, 5 got one (`crossbox_refusal_test.go`). Left: red-prove the 4 new tests that were not red-proved (as the restore-directive one was), and the live read-only check with one demo box's key against the other demo box's id. | OPEN — filed 2026-10-12 by the security review | — | Red-prove the 4 tests; run the live GET check on the two demo boxes | CC |
| **R-924** | Security & access | P2 | **The operator signing keys exist only on DooPlex, with no passphrase and in no backup — a loss of DooPlex means no box ever accepts a signed agent update, config bundle or OS step again without an on-site re-enrollment.** MEASURED 2026-10-09: `/mnt/5_hdd/felhom.eu/felhom-op-operational`, `felhom-rec-recovery`, `felhom_op_ed25519` (0600 `kisfenyo`); `ssh-keygen -y -P ''` opens all three (no passphrase); `/mnt/5_hdd/felhom.eu` is in no backup set, the off-site job does not carry them. `04` §1 says the operational key is "passphrase-protected" and the recovery key "kept offline" — today neither holds (custody ruling 1 of 2026-09-16 put both on DooPlex for this phase; `04` §3.1). Both keys share one fate, so the cold key cannot do its one job (re-pin after losing the operational key). `runbooks/total-loss-of-dooplex.md` S6. | NARROWED — **2026-10-23 (D32):** S6a/S6b are on the current sheet. LEFT: the operator prints it. **NARROWED 2026-10-09 — operator ruling: option A** (print both AND copy them). The three key files and their public halves ride the nightly encrypted DooPlex→ep0 copy (`scripts/dooplex-offsite/`, a missing key refuses the push); the Sunday restore test proves each private key still derives its own public half (never printed). **LEFT:** the operator prints S6a/S6b (`runbooks/break-glass-sheet.md`); the keys still have no passphrase (custody ruling 1 of 2026-09-16 stands until the first sale). **2026-10-23 night — survey (`audits/dooplex-survival-2026-10-22/PLAN.md`, G2):** the three key files are on `sda1`, the same disk as DooPlex's local backup tree; their only off-box copy is the S1-encrypted nightly one. Passphrase: unchanged by the custody ruling. | operator: print | Operator: print the two keys; then close | operator |
| **R-132** | Security & access | P3 | **`curl -w '%{redirect_url}'` reconstructs the request URL WITH its basic-auth credential** — so a `-u ":$HUB_PW"` call that never put the password in a URL still printed it **Merged 2026-10-05 from R-350 (duplicate):** (1) 2026-08-20 occurrence: POST /configuration/artifacts answers 303; leak lives only in the CC transcript under ~/.claude/projects/ on DooPlex, not in git/evidence (checked then). (2) `-v` and `--libcurl` also re-render the credential, not only %{redirect_url}; confirm redirects with %{http_code} + follow-up GET. (3) Rotation path: hub /configuration form (current_password/new_password/confirm_password); DB override wins over ConfigMap (break-glass); CC can rotate file-to-file without printing (operator-present-one-time-secrets) if asked. | **NARROWED 2026-10-20 — the rotation is DONE:** the operator changed the hub password on 2026-10-15 and the `HUB_PW` line is gone (`audits/hub-tokens-2026-10-15/C153-live.txt:18`; CC uses its own token since hub 0.152.0). **Left, the operator's:** should the break-glass `password_hash` in `manifests/hub.yaml` (a public repository) be emptied or replaced? The DB override wins at login, so the old hash no longer opens the hub. **WAITING-ON-OPERATOR** — **ACTION: rotate `HUB_PW`** **Folded R-580 2026-10-03** (the same `curl -w %{redirect_url}` credential echo, seen again 2026-09-18). **Note 2026-10-12 (security review):** `manifests/hub.yaml` also carries the hub login's bcrypt hash in this public repository (the break-glass field); when `HUB_PW` is rotated, decide whether that field should stay empty. | the operator's word on the `manifests/hub.yaml` hash field | Happened on 2026-07-31 while red-proofing the R-120 gate: the hub operator password was written to the session transcript by the write-out format, not by the request. `-u` is safe; the *reporting* was not. Rule: read the redirect from `-D -` and grep `^Location:`, never `%{redirect_url}`, on any authenticated call. Rotate the hub password (`/configuration` → Login password; ConfigMap `auth.password_hash` is the reset path) and update `~/.config/credentials` | Viktor |
@@ -261,6 +265,7 @@ stopping line that lies.
| **R-1194** | Security & access | P3 | **On a fresh box the operator's break-glass SSH door was broken from the first minute: `oob_degraded` „felhom-sshd config invalid (sshd -t fails)".** Rehearsal 2026-10-20, Tester4-816e21, mail at 12:03 UTC (one minute after the host record was created): details `active:false, config_invalid:true, felhom_sshd_port:0, operator_key_configured:false, operator_key_reported:true, reachable:false`. Possibly the shape of a customer with no operator key set (Tester4 is a test customer) — then the alarm is a false one on every such box; or a real config defect. Not diagnosed (no shell). Checked the same day: the only `oob_degraded` in the operator mailbox in 30 days, and no recovery mail followed; the report says port 0. Two candidate mechanisms in the agent (`internal/felhomsshd/health.go:63-66`): `sshd -t -f <conf>` run by the NON-root agent fails on unreadable host keys, or a config rendered before the desired state arrived (port 0). **CAUSE FOUND AND FIXED 2026-10-21 night** (`audits/night-2026-10-21/P5-checks/`): reproduced on a fresh box from the public ISO — `oob_degraded` mailed 20:34 CEST while felhom-sshd was applied 0.4 s after the check and is healthy (port 8822 listening, `sshd -t` passes as the agent's user through its sudo grant — so the non-root theory is FALSE; without sudo it fails on the host key, which the agent never does). The first host report runs before the felhom-sshd loop's first pass and reads a config never rendered. Fix: agent `0da792e` — no OOB stanza until the first pass has run (the hub does not evaluate a missing one; a failed pass counts). `TestR1194_NoOOBStanzaBeforeTheFirstPass` red-proved. | WATCHING — released in agent v0.162.0 (2026-10-22, operator yes; on the 3 test boxes); the false alarm comes only on a FRESH box's first report | the next fresh install with agent ≥ 0.162.0 | At the next fresh install read the hub's events for `oob_degraded` in the first hour (none expected); then close | CC |
| **R-1237** | Security & access | P3 | **The nightly CC-secrets sweep found stored one-time codes in a session record dated 2026-10-23: 14 names in one file (bind tokens and setup codes of test boxes — NIGHT_2026_10_23_*, FIXES_2026_10_21_*, NIGHT_2026_10_21_*, REHEARSAL_2026_10_20_* — and R_DEMO_FELHOM in a file of 2026-10-20).** Mail „[DooPlex CC secrets] 2 secret name(s) found in old session records", 2026-10-23 01:57 UTC, read in the day session (names only). One file holding all of them suggests one command printed many stored values at once (a listing or a dump) in the night session. All but R_DEMO_FELHOM are one-time install codes of test boxes; NIGHT_2026_10_23_* die when Tester4-16fdef is deleted (the operator's do list). | OPEN | — | CC: find the file and the command by the sweep's own report (names only), add a hook shape for that command if it is not one; R_DEMO_FELHOM (demo-felhom's recovery code) — the operator decides whether to rotate it | CC |
| **R-1248** | Security & access | P3 | **An app's own numbers can lie: an attacker with code inside an app's container can answer the app's API with whatever matches its flood, and the upload watch (R-1244) would then call it explained.** Measured remedy, not built: a per-container upload ceiling with `tc` from a helper container in the app's network namespace — on scratch 9202 (unprivileged) a flood was held at 19.9–20.1 Mbit/s and the app kept answering (`audits/SPIKE-upload-watch-2026-10-23.md` §5). Costs: a helper image with `tc` (a new external image, or `tc` in the controller image), `NET_ADMIN` for that helper, re-applied after each app restart. | OPEN | an operator decision (the new image / capability) | Decide; if yes, CC builds the ceiling for the download and media apps first | operator |
| **R-1309** | Security & access | P4 | **What no automated source shows: a fix announced only by mail, forum or a blog we do not read; a security fix nobody calls one (cloudflared 2026.10.2's „bump distroless image"); closed-source apps (Plex, Emby).** The watch (R-1303) shows these only as BEHIND (weekly). The vendor mails the operator receives stay a source. `audits/security-watch-2026-10-26/SPIKE.md` | OPEN — filed 2026-10-26 (a stated limit) | — | none until a vendor offers a feed; add a vendor's feed to `security_watch.FEEDS` when one exists | CC |
## Box system & updates — 14 rows (P2 1, P3 8, P4 5)
documentation/runbooks/monthly-floating-retest.md
+6
View File
@@ -57,6 +57,12 @@ code-server) are rebuilt upstream weekly under the same tag, so most months they
## 4a. Infrastructure pins (R-838, 2026-10-04)
**Since 2026-10-26 the BEHIND check is NIGHTLY and automatic (R-1303):** `felhom.eu/scripts/security_watch.py` runs in
CI at 03:40 UTC over every box pin, every build base and every catalog image, mails a security notice that night and
BEHIND in a Monday summary (`08-alarm-ladder.md` §11). `check-infra-pins.py` below stays as the by-hand view. What this
monthly run still does that the watch cannot: the RE-TEST of same-name fixes (§4) — a rebuilt image under the same tag
has no notice and no newer tag.
The box's three built-in containers — traefik, cloudflared, filebrowser — are pinned in
`felhom-controller/controller/internal/infra/infra.go` (`TraefikImage`, `CloudflaredImage`, `FileBrowserImage`). They are
**not** catalog templates, so `retest-floating.py` never sees them. Each month: