felhom.eu/documentation/audits/security-app-updates-2026-10-27/triage-notes/uptime-kuma.md

uptime-kuma — triage (pin louislam/uptime-kuma:2.5.5, the normal (root) image, not -rootless)

Template: setup_gate: true; single-user app (the one account is the admin).

Notices

• GHSA-98hr-q8q8-5j23 rootless sudo privilege escalation — NOT-A-FINDING: affects only the -rootless image variants; we ship 2.5.5.
• GHSA-qjxc-h5jf-c7rj SSRF to cloud metadata (range *, no patch, "will not fix") — NOT-A-FINDING, decided by hand: the advisory itself says it is a deployment-platform issue for cloud IMDS (169.254.169.254); a Felhom box is home hardware with no metadata service, and the only account is the admin, who is meant to monitor internal URLs.
• release:2.5.8 — REAL: GHSA-v2p3-6f5h-6hhf "[Admin Only] RCE" (details not public yet; severity unsure). Login: admin. Reachable: only with the household's admin login.
• release:2.5.7 — REAL runtime fix: Node.js 22.23.4, rejects the leaked eMudhra CA.
• release:2.5.6 — weak: "chore: Update dependencies" (no CVE named); it is also the release that fixes GHSA-98hr (rootless only). Treat as hygiene.

Fix

Smallest fixing the real item: 2.5.8. TARGET louislam/uptime-kuma:2.5.8 (Docker Hub tag exists, no v). Same main (2): yes. Breaking (3 releases read 2.5.6..2.5.8): 2.5.8 DROPS TLS support for the TCP Port monitor — existing TLS TCP monitors silently become plain TCP monitors (a removed option + data conversion). Nothing else. Lane: SECURITY_FIX if the operator accepts the TCP-TLS removal as minor (Felhom ships no TCP-TLS monitors by default); strictly by the rule it is a removed feature → BIG_STEP. I lean SECURITY_FIX: admin-only RCE + CA distrust, and the removed option "never worked as expected" upstream. Classifier note: GHSA-98hr's package name is "Rootless Docker Image only" — the watch should skip it for non-rootless tags; GHSA-qjxc (range *, no patch, platform issue) should be filtered as permanent won't-fix.