10 KiB
10 KiB
Security app updates — the triage (2026-10-27)
Input: the security watch run WITH the GitHub key (local dry run 2026-10-27 ~07:50 UTC, the same code as CI job 2415):
38 pins with open notices — 3 box programs and 35 app pins in 32 apps (the seed's 30 pins were a no-key half; the
key read every repo). Each app was read by hand: every GHSA in full, every release body between our pin and the fix,
our template's gates and env. Per-app notes, with the tags and ids read: triage-notes/<app>.md (four read-only helper
sessions, brief triage-notes/_HELPER-BRIEF.md, the fences in full; checked and merged by CC).
Fleet today (hub /apps, 24 h): four controllers report — Tester 1, demo-hp, demo-felhom, Tester4 — no household.
Of the 32 apps only BookStack, Paperless-ngx, PrivateBin, BentoPDF, Docmost, Home Assistant and RomM run on any box.
How a box is exposed: every app has a public HTTPS name through the tunnel. setup_gate closes it to strangers
only until the first admin exists; family_gate keeps it behind the household door for good; signup_block refuses
the public sign-up path. „Main version" = the first number (the project's major_of); a step inside it goes by the
lane only when the notes between pin and target show no file conversion, no new required setting and no removed option.
Lane A — same main version: a security_fix step (Part 2)
| # | App | Pin → TARGET | Real / total | Worst real (login?) | Reachable on a box | Id(s) the step carries | Fixture | State |
|---|---|---|---|---|---|---|---|---|
| 1 | rallly | 4.15.3 → 4.16.3 | 1+3 rel / 1+4 | critical RCE (none) | yes, after setup | GHSA-gmq4-f8j5-8w8q | yes | pending |
| 2 | romm | 5.3.1 → 5.4.1 | 6 / 6 | high: unauth WebSocket scan deletes media (none) | yes | GHSA-722m-w9p2-xv2j, -q7fg-…, -7jw3-…, -9q83-… | yes | pending |
| 3 | code-server | 4.129.0 → 4.143.1 (lscr.io) | 1 / 1 | high: Node Brotli before sign-in (none, inferred) | yes, no gate | CVE-2026-111497 (Node Oct 2026) | no (seed none) | pending |
| 4 | outline | 1.10.1 → 1.12.0 | 8 / 13 | high: unpublished doc keeps its share (none) | yes | GHSA-rq53-m97j-f2pg, -97vv-…, -w8vg-… | yes | pending |
| 5 | vikunja | 2.6.0 → 2.7.1 | 42 / 45 | high (any user; m687 needs the victim's browser) | own login (setup+signup gates) | GHSA-m687-p538-r5hp, -hq66-…, -5q33-… | yes | pending |
| 6 | homebox | 0.26.2 → 0.27.1 | 14 / 15 | high: group takeover (any user) | own login; unauth register notices blocked by signup_block | GHSA-jm28-2xm3-m6m5 … | yes | pending |
| 7 | n8n | 2.42.1 → 2.44.7 | 12 / 13 | high (a workflow builder) | own login | GHSA-m7gv-…, -mp7q-…, -wvjj-… | yes | pending |
| 8 | privatebin | 2.0.6 → 2.1.0 | 2 / 2 | medium: fake pop-up (none) | yes, public by design | GHSA-w873-3ghv-hmh6 | yes | pending |
| 9 | docmost | 0.96.0 → 0.97.0 | 1 rel / 1 | unsure: Node 26 + fastify/socket.io (pre-auth surfaces) | yes, after setup | CVE-2026-111497 (Node Oct 2026) | yes | pending |
| 10 | grafana | 13.2.3 → 13.2.4 | 1 rel / 5 | medium: CVE-2026-15577 (read-only user) | own login | CVE-2026-15577 | yes | pending |
| 11 | mealie | v3.28.0 → v3.29.0 | 1 / 1 | medium (any user, 2+ groups) | own login | GHSA-99wf-32rc-2767 | yes | pending |
| 12 | audiobookshelf | 2.37.1 → 2.37.2 | 1 rel / 1 | Node runtime; low in practice | own login | CVE-2026-111497 (Node Oct 2026) | yes | pending |
| 13 | bentopdf | v2.8.6 → v2.8.10 | 1+2 rel / 3+2 | low known (cx8x, a crafted workflow file); v2.8.10's two GHSAs still private | yes, no login by design | GHSA-cx8x-7rrr-r9x8, -v77x-…, -qch9-… | no (seed none) | pending |
| 14 | uptime-kuma | 2.5.5 → 2.5.8 | 1 rel / 2+3 | admin-only code execution (GHSA-v2p3, unpublished) | admin login | GHSA-v2p3-6f5h-6hhf | yes | pending — CAVEAT: 2.5.8 drops TLS on the TCP-port monitor |
| 15 | immich | v3.2.4 → v3.3.5 (server + ml) | 0 GHSA + 1 rel | Node + CA bundle runtime only | own login | CVE-2026-111497 (Node Oct 2026) | yes | optional — lowest |
Lane A′ — same main version but NOT the lane
| App | Pin → TARGET | Why not the lane | Path |
|---|---|---|---|
| wishlist | v0.67.1 → v0.69.0 | critical, no login: /forgot-password returns the reset token in its own response, SMTP or not (PR #818) — but no GHSA/CVE is published, and the lane's authority is a public notice id |
a NORMAL proven step: bench (fixture exists) + box walk, --write-ladder |
| bookstack | 26.09.1 → 26.09.2 (lscr.io) | a real security release (two authorisation leaks between signed-in users) with no CVE/GHSA id | a normal proven step (fixture exists), after the lane batch |
Lane B — a new main version, or a breaking change inside it (Part 3)
| App | Pin → TARGET | Worst real (login?) | Why big | Runs on a box today |
|---|---|---|---|---|
| wanderer | v0.20.0 → v0.21.2 (web + db) | critical: any remote ActivityPub server overwrites records (none); federation has no off switch | new REQUIRED POCKETBASE_PROXY_SECRET on both services; 0.21.1 migration shortens rich text, no downgrade |
no |
| jellyfin | 10.11.11 → 12.4 | critical 6828 (admin after setup); hw73 file read with no login (medium) | 10 → 12; DB conversion with no rollback; /emby + legacy auth removed |
no |
| gokapi | v1.9.6 → v2.2.4 | high 3c22 is self-XSS for the only account | 1 → 2; user system, no downgrade; our first-boot config seed must be re-captured | no |
| seerr | jellyseerr 2.7.3 → ghcr.io/seerr-team/seerr:v3.5.1 |
high rc4w (stranger registers, Plex setups only), mc6w path traversal → RCE (needs a hostile media server) | 2 → 3; new image name; runs as UID 1000 → /app/config chown; config migration |
no |
| karakeep | 0.33.2 + chrome 151 → 0.34.1 + chrome 154.0.8037.57-r1 | high: two CISA-KEV V8 bugs in the crawler's Chromium (--no-sandbox), via content the household saves |
auth library swap (everyone signed out, e-mails lowercased); chrome rebuilt on full Chrome — memory limit and healthcheck to re-measure | no |
| gitea | 1.27.3 → 28.2.0 | critical 7cq7 / 6pv5 (any user); c3cr, hf55 need no login | 1.28 renamed 28.0.0 — no 1.27.4 exists; 28.0 routes git traffic through a new proxy with egress settings | no |
| paperless-ngx | 2.20.15 → 3.3.4 | low (2jhj, needs a setting we do not set) — not reachable | 2 → 3: encryption + API v1 removed, search index rebuilt | YES (4 test boxes) — not urgent |
| homepage | v1.13.2 → v2.7.0 | medium; family_gate, only with a hand-written credentialed widget | 1 → 2: auth rework | no |
| termix | 2.8.0 → 2.9.2 → 26.10.5 | high; 7j7m: the login rate limit is bypassed by a spoofed X-Forwarded-For (no login) | two hops (2.9 must start once); calendar versions; guacd dropped | no |
| tandoor | 2.6.15 → 2.7.2 | high: 5f74 XXE file read, 69q3 (any user) | 2.7.0 removes settings and an endpoint and rewrites the login pages (our probe path, unsure); 2.7.0/2.7.1 break invite links with sign-up off → straight to 2.7.2 | no |
| sparkyfitness | v0.17.3 (both images) | medium p8cf (any user), cmmf (a leaked photo URL) | no fix named in any release; 0.17 → 1.x is R-785's big step anyway | no |
No fix exists (Part 4)
| App | Notice | What blocks it in our template | Pick |
|---|---|---|---|
| sparkyfitness | GHSA-p8cf-g8rv-gvrq (a user overwrites another user's Withings link), GHSA-cmmf-53wf-r5gv (owner-only photos readable by URL) | own login (any household account); cmmf needs the full photo URL | see PICKS.md |
| gitea | GHSA-rqhx-647v-wx32 (SSRF through a redirect in repository migration; the upstream patch was reverted) | own login; migrations are on by default | see PICKS.md |
| karakeep, bentopdf | — | the watch said „no fixed version"; fixes exist (karakeep-chrome 154/156; bentopdf's two are in the Cloudflare CORS-proxy worker we neither ship nor deploy) | none needed |
NOT-A-FINDING
| App / notice | Reason |
|---|---|
| calcom GHSA-p3f6-52gv-cj7m | the project's own GitHub workflow (2024), not the product |
| calcom GHSA-cpf2-q635-xrwx | range is the hosted service / ≤ 3.1.4 (2023); our pin v6.2.0 |
| home-assistant GHSA-jff5-5j3g-vhqc | a GitHub Actions advisory (ecosystem actions) of the project's CI, fixed 2023 |
| glance GHSA-r225-jhr6-68cc | only when Glance's own login is configured; our seeded config sets none, and family_gate stands in front |
| dawarich release 1.17.0 | the hit is „Node 20 … no longer receives security fixes" — a maintenance swap, not a fix (1.16.0 carries two hardening fixes the watch missed — optional) |
| immich GHSA-8244-8vpr-vp9c | the range is untagged main@<sha> builds; the fix commit is already inside v3.2.4 |
| grafana four GHSAs of 2022/2023 | fixed in Grafana 7.5 / 8.x / 9.x years ago; malformed ranges |
| uptime-kuma GHSA-98hr, GHSA-qjxc | rootless image only (we run the normal one); a cloud-metadata issue the project closed as won't-fix |
| outline 5 SSO / GitLab / cross-team notices | our template configures no SSO and no GitLab integration (e-mail link + passkey) |
| vikunja 3 notices | the xgo release toolchain; the Trello/Todoist/MS To Do migrators (off) |
| gitea GHSA-x4q3-gcj3-m6cf | the package is the Actions runner, which we do not ship |
| termix GHSA-frx8, GHSA-r9gw | the Electron desktop client, which we do not ship |
| paperless-ngx GHSA-c8f3 | range 3.0–3.3.2; we run 2.20.15 |
| n8n GHSA-365g-vjw2-grx8 | Execute Command is left out by default in 2.x, and our compose keeps that default |
| wishlist v0.68.0 nodemailer (GHSA-6vj9-mwq6-2f5v) | needs several SMTPS transports in one process; one transport, and we set no SMTP |
Box programs (Part 5)
| Program | Pin → TARGET | Real | Breaking (notes read) |
|---|---|---|---|
| traefik | v3.7.13 → v3.7.16 | 12 notices; none reaches our config (docker + file providers, no FastProxy, no NTLM backend, no k8s) — R-1304 | migration guide v3.7.14–16: k8s providers' names, OTel histograms, CONNECT rejected with 501; none touches us |
| file manager | 1.5.6-stable → 1.5.8-stable | GHSA-qx86-4v5r-26g5 (TOTP re-enrol), GHSA-3846-gh75-gp3m (upload share) — R-1305 | 1.5.7-stable is superseded: it broke existing TOTP logins; 1.5.8-stable supersedes it |
| cloudflared | 2026.10.3 → 2026.10.4 | VULN-176088 „Allowlist debug endpoints on the metrics server"; our metrics port is not reachable from outside — low | none |