6.1 KiB
6.1 KiB
Security notices first seen since 2026-10-29 — the triage (2026-11-02 night)
Input: the watch's memory (documentation/security-watch/state.json, every notice with first ≥ 2026-10-29) plus the fixed
watch's dry run (part1/dry-local-after-fix.log, 13 new lines). Each notice was read in its own text (the release body, the GHSA);
the versions of the waiters were read from the image (waiters.txt), never from notes. Fleet: three test boxes report, no
household. „Lane" = a security_fix step (09 §3 decision 255): same main version, a public id, a proven 9202 walk.
The table of the brief
| App (our pin) | Notice | Real? | Reach in our template | Fixed in | What happens |
|---|---|---|---|---|---|
| Vaultwarden 1.37.4-alpine | release 1.37.5: GHSA-x9cq-f669-vrr4 (website icons, medium 5.3), GHSA-9pjj-f9g5-3x4c (emergency access, medium 4.3); both still private upstream | real | own login; the icon route is public | 1.37.5-alpine | Lane. Upgrade notes: „invalid values now stop startup" — our template sets none of the named options (grep) |
| Uptime Kuma 2.5.7 | GHSA-86ch-2247-gr56 (unauth RSS cache poisoning by Host header, medium, >= 2.1.0, <= 2.5.8); GHSA-v2p3-6f5h-6hhf (admin-only RCE via Apprise, high, fixed 2.5.8) |
real | RSS only if a public status page exists; v2p3 needs the admin | 2.5.9 | Lane, and it crosses 2.5.8, which the 10-27 batch refused: it drops TLS on the TCP-port monitor. Upstream: „never worked as expected … all existing monitors will become normal TCP monitors". Decided by CC unattended (operator may reverse): the fix outweighs it, no box runs Kuma, and no data is touched. Named on the list |
| n8n 2.44.7 | 12 GHSAs first seen 10-29 | real | own login; two reach before login (GHSA-426f OAuth callback, GHSA-mx4r Asana trigger) |
nine in 2.45.5 / 2.46.1; three only in 3.0.1 (GHSA-9p7v high, GHSA-mx4r, GHSA-2x68) |
Lane to 2.46.4 for the nine; the three go to a big step (a new main version), row filed. GHSA-365g names no fix |
| PrivateBin 2.1.0 | GHSA-hw9p-r7fq-8mvr (comment replay, medium), GHSA-c4gc-8mcm-hh65 (2.1.0's XSS fix is ineffective, medium) | real | public by design | 2.1.1 — no release and no image exist (PrivateBin's newest release is 2.1.0; privatebin/pdo has no 2.1.1 tag) |
No step tonight. Row filed; the watch keeps it open |
| Traefik v3.7.16 (box) | release:traefik@v3.7.17 |
REAL — not the false alarm the brief expected. The word-only line („Point security announcements …") hid a real id in the same notes: GHSA-xv5x-242w-7hf7, high, published 2026-11-02 09:15 UTC: an unauthenticated client holds a backend transport per connection (v3.7.14–v3.7.16) until memory runs out, NTLM backend or not | every box, in front of everything | v3.7.17 | Pin committed, controller c4b6844; proven on 9202 on the test image. First on the release list |
What else was first seen since Thursday
| App (our pin) | Notice | Real? | What happens |
|---|---|---|---|
| Gitea 28.2.0 (catalog) | 21 GHSAs fixed in 28.3.0 (high: GHSA-8p3x OAuth2 auto-link account takeover, GHSA-jh8p, GHSA-37xv, GHSA-8g99, GHSA-32h8, GHSA-9v6p, GHSA-6h2f) |
real | Lane. GHSA-x4q3 is the runner's, not ours (now not listed, R-1310) |
| Gitea 1.26.2 on DooPlex | 19 of the same | real, on the host that holds our code and registry | Not ours to touch: homelab list, filed; first on that list |
| Vaultwarden 1.37.4, Uptime Kuma 2.5.6 on DooPlex | as above | real | Homelab list |
| FileBrowser 1.5.8-stable (box) | GHSA-892f-9h5p-mfc8 (low): /api/settings shows secrets to an ADMIN's token |
real, admin only | R-1305's list; the fix is on 2.1.0-stable (a new main version) |
| cloudflared 2026.10.4 (box) | VULN-183456 (2026.10.5, chi bump), VULN-184686 (2026.10.6, go-jose bump) | real dependency fixes, no public text on reach | Row filed: raise it on a controller release after a tunnel proof (the newest is 2026.10.7). Not pinned tonight: the tunnel is a box's only door, and 9202 has none to prove it on |
| Grafana 13.2.4 | release 13.2.5 names four CVEs (first seen 10-28) | real | Lane. |
| Mealie v3.29.0 | v3.30.0: „update dependency pillow to v13 [security]" | a dependency fix, no id | Normal step (bench + box, drill only). v3.30.0 also removes OPENAI_CUSTOM_PROMPT_DIR (imported automatically; our template does not set it). Row filed |
| Termix 26.10.5 | v26.10.6: „body-parser is updated to 2.4.0 for a security fix" | a dependency fix, no id | Normal step, drill only. Row filed |
| Meilisearch v1.41.0 (karakeep), v1.36.0 (wanderer) | v1.55.1 / v1.56.1: „important security fixes" (long filters, rustls) | real, but the search engine sits on the app's private network | Not reachable from outside. A jump of 15–20 versions needs its dump migration: a big step. Row filed |
| Actual 26.9.0 | GHSA-p7p2-pm6f-rg6x (Electron fuse, desktop app) | NOT-A-FINDING: the desktop client, we run the server |
Fixed in 26.11.0 anyway, the waiter's step below |
| Paperless 3.3.4 on DooPlex | v3.4.0 „bump some frontend deps for security fixes" | real | Homelab list |
The six HTTP2Shell waiters (CVE-2026-111497) — read from the image
| App | Pin | Newest same shape | Runtime in the newest | Fixed release? | What happens |
|---|---|---|---|---|---|
| ActualBudget (R-1336) | 26.9.0 (Node 24.20.0) | 26.11.0 | Node 24.22.1 | YES, same main | Lane |
| cal.com (R-1329, R-1325) | v6.2.0 (Node 20.20.0) | v6.2.0 | Node 20.20.0 | no | Waits |
| Calibre-Web (R-1337) | v4.0.8 (Python Brotli 1.2.0) | v4.0.8 | same | no | Waits |
| Paperless (R-1331) | 2.20.15 (Python Brotli 1.1.0) | 3.4.1 | clean (3.4.0 and 3.4.1; 3.3.4 still bad) | YES, a new main version | Big step: bench + 9202 + undo, drill only |
| RomM (R-1330) | 5.4.1 (Node 24.18.1) | 5.4.1 | same | no | Waits (D61) |
| SparkyFitness | v0.17.3 (Node 24.18.0) | v1.11.0 | Node 24.22.1 (v1.10.0 and v1.11.0; v1.9.0 still bad) | YES, a new main version | Big step; R-784 (licence) and R-785 stand before it |
The walks
See walks/<app>/walk.txt and box-verdict-<app>.json; the result of each is in the close-out below.