R-1300 (P1, Security): cloudflared 2026.9.3 trusts the eMudhra weak-key intermediates — the list, the origin check (not affected), evidence

2026-10-26 20:50:39 +01:00
1 parent 3720bd1f03
commit ffb91d89e7
@@ -0,0 +1,27 @@
+# cloudflared 2026.10.3 — the eMudhra notice (R-1300), 2026-10-26 evening
+
+**The notice.** Cloudflare, 2026-10-20 (blog „8 eMudhra certificates are compromised"): eight eMudhra (emSign)
+intermediate CA keys were weak (recoverable from the public certificates; six TLS, two code-signing). cloudflared
+before 2026.10.2 trusts them. Docker users take the fixed image. Cloudflare: „do not resolve these errors by disabling
+verification". Release notes: 2026.10.2 = Go 1.27.3 + new distroless base (the trust store); 2026.10.3 = newer
+debian base + Go bump. 2026.10.4 (2026-10-26, today) adds a metrics-endpoint allowlist (VULN-176088) — not taken:
+under a day old, and the notice names 2026.10.3.
+
+**Image.** `cloudflare/cloudflared:2026.10.3` index digest
+`sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39` (Docker Hub API and a pull on 9202 agree;
+amd64 `sha256:c3f24df7…`); `--version` = `cloudflared version 2026.10.3 (built 2026-10-21-13:24 UTC)`.
+(`part3-image-check.txt`)
+
+**Part 1 — the list.** Three boxes report to the hub (demo-felhom, demo-hp, Tester 1); each guest 9201 runs
+`cloudflare/cloudflared:2026.9.3` (`part1-boxes.txt`, `part1-hub-hosts.txt`). 9202 (scratch) has no tunnel. Tester 2: no box.
+DooPlex: no cloudflared in k3s, Docker, systemd, dpkg or processes; the same queries find traefik/the hub (control)
+(`part1-dooplex.txt`). Cloudflare account: CC holds no Cloudflare token (`sec list`); the connector versions are the
+operator's look in Networking → Tunnels.
+
+**Part 2 — the https-origin trap.** Every tunnel's remote route (cloudflared's own „Updated to new configuration" log
+line, all three boxes): `*.<domain>` → `https://traefik`, `originRequest.noTLSVerify: true`, then `http_status:404`
+(`part2-remote-config.txt`). traefik answers SNI `traefik` with `CN=TRAEFIK DEFAULT CERT`, self-signed
+(`part2-origin-cert.txt`). No eMudhra chain → the new trust store refuses nothing on the origin leg: **the trap does
+not apply.** The `noTLSVerify` is the day-0 recipe (R-510) for a leg that never leaves the guest (cloudflared and
+traefik alone on the /29 `felhom-tunnel`); not changed tonight (the brief forbids touching certificate checks, and
+turning verification ON needs traefik to present a cert cloudflared can verify — a design question, not tonight).
@@ -0,0 +1,26 @@
+== felhom-pve
+demo-felhom
+VMID       Status     Lock         Name                
+9201       running                 demo-felhom         
+-- ct 9201
+felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.345.0 Up 6 hours (healthy)
+cloudflared cloudflare/cloudflared:2026.9.3 Up 5 days (healthy)
+== demo-hp
+demo-hp
+VMID       Status     Lock         Name                
+9201       running                 demo-hp             
+9202       running                 demo-hp-scratch     
+9401       stopped                 upgrade-harness     
+-- ct 9201
+felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.345.0 Up 6 hours (healthy)
+cloudflared cloudflare/cloudflared:2026.9.3 Up 3 days (healthy)
+-- ct 9202
+felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.343.0 Up 2 hours (healthy)
+       341 night1004-tester1    running    8192             200.00 1364274   
+== root@192.168.0.154
+felhom
+VMID       Status     Lock         Name                
+9201       running                 tester-1            
+-- ct 9201
+felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.345.0 Up 6 hours (healthy)
+cloudflared cloudflare/cloudflared:2026.9.3 Up 2 days (healthy)
@@ -0,0 +1,15 @@
+== k3s pods
+== k3s images any
+== docker
+== systemd
+== dpkg
+== processes
+2667091 /bin/bash -c source /home/kisfenyo/.claude/shell-snapshots/snapshot-bash-1793042538348-zvqq4e.sh 2>/dev/null || true && shopt -u extglob 2>/dev/null || true && { \builtin unalias -- 'unsetenv'
+2667092 /bin/bash -c source /home/kisfenyo/.claude/shell-snapshots/snapshot-bash-1793042538348-zvqq4e.sh 2>/dev/null || true && shopt -u extglob 2>/dev/null || true && { \builtin unalias -- 'unsetenv'
+2667753 /bin/bash -c source /home/kisfenyo/.claude/shell-snapshots/snapshot-bash-1793042538348-zvqq4e.sh 2>/dev/null || true && shopt -u extglob 2>/dev/null || true && { \builtin unalias -- 'unsetenv'
+== positive control: same queries find traefik/hub
+1
+2
+1
+== docker images cached
+== homelab-manifests mentions
@@ -0,0 +1,4 @@
+Host | Customer | Agent | Proxmox / kernel | Status | Guests | CPU | Mem | Disk | Cloudflared | Worst Storage
+demo-felhom-8363b5 | Demo Ügyfél | 0.166.0 floor: declared MinAgent | 9.2.21 7.0.14-25-pve | ONLINE | 1/2 | 0% | 20% | 35% | running (connected) | 35% local
+demo-hp-bb76ea | Demo HP | 0.166.0 floor: declared MinAgent | 9.2.21 7.0.14-25-pve | ONLINE | 1/2 | 11% | 45% | 61% | running (connected) | 61% local
+tester-1-d70be4 | Tester 1 | 0.166.0 floor: declared MinAgent | 9.2.2 7.0.14-22-pve | ONLINE | 1/2 | 7% | 33% | 27% | running (connected) | 27% local
@@ -0,0 +1,21 @@
+== felhom-pve
+traefik=172.20.0.2
+/bin/openssl
+ 0 s:CN=TRAEFIK DEFAULT CERT
+   i:CN=TRAEFIK DEFAULT CERT
+Verify return code: 18 (self-signed certificate)
+    Verify return code: 18 (self-signed certificate)
+== demo-hp
+traefik=172.26.0.2
+/bin/openssl
+ 0 s:CN=TRAEFIK DEFAULT CERT
+   i:CN=TRAEFIK DEFAULT CERT
+Verify return code: 18 (self-signed certificate)
+    Verify return code: 18 (self-signed certificate)
+== root@192.168.0.154
+traefik=172.22.0.2
+/bin/openssl
+ 0 s:CN=TRAEFIK DEFAULT CERT
+   i:CN=TRAEFIK DEFAULT CERT
+Verify return code: 18 (self-signed certificate)
+    Verify return code: 18 (self-signed certificate)
@@ -0,0 +1,18 @@
+== felhom-pve
+2026-10-21T03:24:06Z INF Starting tunnel tunnelID=8b4edf48-1846-4484-870e-68b48cf43483
+2026-10-21T03:24:06Z INF Version 2026.9.3 (Checksum af73b73c18b1fe8c50293af01630a59789ddd9eb1edb56472fe5559b3a4a340c)
+2026-10-21T03:24:06Z INF GOOS: linux, GOVersion: go1.26.8, GoArch: amd64
+2026-10-21T03:24:07Z INF Updated to new configuration config="{\"ingress\":[{\"hostname\":\"*.demo-felhom.eu\", \"originRequest\":{\"noTLSVerify\":true}, \"service\":\"https://traefik\"}, {\"service\":\"http_status:404\"}], \"warp-routing\":{\"enabled\":false}}" version=1
+cloudflared version 2026.9.3 (built 2026-09-24-16:19 UTC)
+== demo-hp
+2026-10-23T15:34:00Z INF Starting tunnel tunnelID=d7a3c848-d754-46ce-a1c1-ca6bc7a81775
+2026-10-23T15:34:00Z INF Version 2026.9.3 (Checksum af73b73c18b1fe8c50293af01630a59789ddd9eb1edb56472fe5559b3a4a340c)
+2026-10-23T15:34:00Z INF GOOS: linux, GOVersion: go1.26.8, GoArch: amd64
+2026-10-23T15:34:01Z INF Updated to new configuration config="{\"ingress\":[{\"hostname\":\"*.enkisfelhom.hu\", \"originRequest\":{\"noTLSVerify\":true}, \"service\":\"https://traefik\"}, {\"service\":\"http_status:404\"}], \"warp-routing\":{\"enabled\":false}}" version=1
+cloudflared version 2026.9.3 (built 2026-09-24-16:19 UTC)
+== root@192.168.0.154
+2026-10-24T17:47:21Z INF Starting tunnel tunnelID=52d0c214-b833-477c-86d8-f787d9b550dd
+2026-10-24T17:47:21Z INF Version 2026.9.3 (Checksum af73b73c18b1fe8c50293af01630a59789ddd9eb1edb56472fe5559b3a4a340c)
+2026-10-24T17:47:21Z INF GOOS: linux, GOVersion: go1.26.8, GoArch: amd64
+2026-10-24T17:47:22Z INF Updated to new configuration config="{\"ingress\":[{\"hostname\":\"*.enkicsifelhom.hu\", \"originRequest\":{\"noTLSVerify\":true}, \"service\":\"https://traefik\"}, {\"service\":\"http_status:404\"}], \"warp-routing\":{\"enabled\":false}}" version=2
+cloudflared version 2026.9.3 (built 2026-09-24-16:19 UTC)
@@ -0,0 +1,4 @@
+docker.io/cloudflare/cloudflared:2026.10.3
+cloudflare/cloudflared@sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39 2026-10-21T13:26:38.565206178Z
+cloudflared version 2026.10.3 (built 2026-10-21-13:24 UTC)
+removed