konairius/homelab
10
0
Fork 0
Code Issues 11 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

security: agent-proposed fixes (2026-05-31) #11

Merged
k.renner merged 1 commits from security-fix/2026-05-31-586221b into master 2026-06-13 10:13:14 +00:00
Conversation 0 Commits 1 Files Changed 1
+91
security-bot commented 2026-05-31 12:27:31 +00:00
Member
Copy Link
Copy Source

Summary

Fixed 0 of 430 findings. All 430 findings skipped with reasons below.

The IaC scan (trivy-iac.json) returned no CRITICAL or HIGH severity misconfigurations — only Go module package inventory data from dns-server/go.mod. All 430 CRITICAL/HIGH findings are image-level CVEs across 14 container images; image vulnerabilities are managed by Flux's image-reflector and image-automation controllers and are out of scope for this agent.

Fixed

(none)

Skipped

All image vulnerability findings are skipped because container image tags in this repository are managed by Flux image automation controllers, which open their own commits when new images are published. Tag bumps must not be proposed here.

CRITICAL severity (13 unique CVEs across images)

  • CVE-2023-24538 (ghcr.io/goauthentik/server, woodpeckerci/woodpecker-server, woodpeckerci/woodpecker-agent, netbirdio/*) — golang html/template: backticks not treated as string delimiters — image vulnerability, out of scope
  • CVE-2023-24540 (same images as above) — golang html/template: improper handling of JavaScript whitespace — image vulnerability, out of scope
  • CVE-2024-24790 (ghcr.io/goauthentik/server, netbirdio/*, woodpeckerci/*) — golang net/netip: unexpected behavior from Is methods for IPv4-mapped IPv6 addresses — image vulnerability, out of scope
  • CVE-2024-56171 (tensorchord/pgvecto-rs:pg16-v0.3.0) — libxml2: use-after-free — image vulnerability, out of scope
  • CVE-2025-43859 (ghcr.io/icereed/paperless-gpt:latest) — h11: accepts malformed chunked-encoding bodies — image vulnerability, out of scope
  • CVE-2025-64459 (ghcr.io/icereed/paperless-gpt:latest) — Django: SQL injection — image vulnerability, out of scope
  • CVE-2025-68121 (ghcr.io/goauthentik/server:latest) — crypto/tls: incorrect certificate validation during TLS session resumption — image vulnerability, out of scope
  • CVE-2025-6965 (docker.io/library/postgres:15.17) — sqlite: integer truncation — image vulnerability, out of scope
  • CVE-2026-31789 (tensorchord/pgvecto-rs:pg16-v0.3.0, docker.io/library/postgres:15.17) — openssl: heap buffer overflow on 32-bit systems from large X.509 certificate processing — image vulnerability, out of scope
  • CVE-2026-33186 (ghcr.io/goauthentik/server:latest, netbirdio/*, woodpeckerci/*) — google.golang.org/grpc: authorization bypass due to improper HTTP/2 path validation — image vulnerability, out of scope
  • CVE-2026-33816 (ghcr.io/goauthentik/server:latest) — github.com/jackc/pgx: memory-safety vulnerability — image vulnerability, out of scope
  • CVE-2026-33845 (tensorchord/pgvecto-rs:pg16-v0.3.0, docker.io/library/postgres:15.17) — gnutls: denial of service via DTLS zero-length fragment — image vulnerability, out of scope
  • CVE-2026-42010 (tensorchord/pgvecto-rs:pg16-v0.3.0, docker.io/library/postgres:15.17) — gnutls: authentication bypass via NUL character in username — image vulnerability, out of scope

HIGH severity (78 unique CVEs, abbreviated)

78 HIGH-severity CVEs spread across the same 14 images (full list: CVE-2022-27664, CVE-2022-28131, CVE-2022-2879, CVE-2022-2880, CVE-2022-29804, CVE-2022-30580, CVE-2022-30630, CVE-2022-30631, CVE-2022-30632, CVE-2022-30633, CVE-2022-30634, CVE-2022-30635, CVE-2022-32189, CVE-2022-41715, CVE-2022-41716, CVE-2022-41720, CVE-2022-41722, CVE-2022-41723, CVE-2022-41724, CVE-2022-41725, CVE-2022-49043, CVE-2023-24534, CVE-2023-24536, CVE-2023-24537, CVE-2023-24539, CVE-2023-29400, CVE-2023-29403, CVE-2023-31484, CVE-2023-39325, CVE-2023-45283, CVE-2023-45287, CVE-2023-45288, CVE-2023-52425, CVE-2024-25062, CVE-2024-34156, CVE-2024-55549, CVE-2024-56406, CVE-2025-15467, CVE-2025-22868, CVE-2025-22869, CVE-2025-24855, CVE-2025-24928, CVE-2025-27113, CVE-2025-30204, CVE-2025-31115, CVE-2025-32414, CVE-2025-32415, CVE-2025-32988, CVE-2025-32990, CVE-2025-4565, CVE-2025-47273, CVE-2025-47287, CVE-2025-49794, CVE-2025-49796, CVE-2025-57833, CVE-2025-59530, CVE-2025-6020, CVE-2025-61726, CVE-2025-61729, CVE-2025-64458, CVE-2025-66418, CVE-2025-66471, CVE-2025-67221, CVE-2025-68973, CVE-2025-69223, CVE-2025-69421, CVE-2025-7424, CVE-2025-8714, CVE-2025-8715, CVE-2026-0994, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006, CVE-2026-21226, CVE-2026-21441, CVE-2026-22184, CVE-2026-2332, CVE-2026-23949, CVE-2026-24049, CVE-2026-25679, CVE-2026-26007, CVE-2026-26209, CVE-2026-27459, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390) — all image vulnerabilities, out of scope.

Notes

  • The IaC scan (trivy-iac.json) contained only Go module package inventory from dns-server/go.mod with no Misconfigurations results at any severity level. There are no IaC fixes to apply.
  • The most heavily affected images are tensorchord/pgvecto-rs:pg16-v0.3.0 (113 findings) and ghcr.io/goauthentik/server:latest (109 findings). Both are managed by Flux image automation and will be remediated when upstream publishes patched images.
  • Several high-priority CRITICAL findings warrant attention from a reviewer even though they cannot be fixed here: CVE-2026-42010 (GnuTLS auth bypass) and CVE-2026-33186 (gRPC authorization bypass) affect runtime services. Upstream patches should be tracked.
  • Scan performed by Trivy 0.69.3 on 2026-05-31.
## Summary Fixed 0 of 430 findings. All 430 findings skipped with reasons below. The IaC scan (`trivy-iac.json`) returned no CRITICAL or HIGH severity misconfigurations — only Go module package inventory data from `dns-server/go.mod`. All 430 CRITICAL/HIGH findings are image-level CVEs across 14 container images; image vulnerabilities are managed by Flux's image-reflector and image-automation controllers and are out of scope for this agent. ## Fixed _(none)_ ## Skipped All image vulnerability findings are skipped because container image tags in this repository are managed by Flux image automation controllers, which open their own commits when new images are published. Tag bumps must not be proposed here. ### CRITICAL severity (13 unique CVEs across images) - **CVE-2023-24538** (`ghcr.io/goauthentik/server`, `woodpeckerci/woodpecker-server`, `woodpeckerci/woodpecker-agent`, `netbirdio/*`) — golang html/template: backticks not treated as string delimiters — _image vulnerability, out of scope_ - **CVE-2023-24540** (same images as above) — golang html/template: improper handling of JavaScript whitespace — _image vulnerability, out of scope_ - **CVE-2024-24790** (`ghcr.io/goauthentik/server`, `netbirdio/*`, `woodpeckerci/*`) — golang net/netip: unexpected behavior from Is methods for IPv4-mapped IPv6 addresses — _image vulnerability, out of scope_ - **CVE-2024-56171** (`tensorchord/pgvecto-rs:pg16-v0.3.0`) — libxml2: use-after-free — _image vulnerability, out of scope_ - **CVE-2025-43859** (`ghcr.io/icereed/paperless-gpt:latest`) — h11: accepts malformed chunked-encoding bodies — _image vulnerability, out of scope_ - **CVE-2025-64459** (`ghcr.io/icereed/paperless-gpt:latest`) — Django: SQL injection — _image vulnerability, out of scope_ - **CVE-2025-68121** (`ghcr.io/goauthentik/server:latest`) — crypto/tls: incorrect certificate validation during TLS session resumption — _image vulnerability, out of scope_ - **CVE-2025-6965** (`docker.io/library/postgres:15.17`) — sqlite: integer truncation — _image vulnerability, out of scope_ - **CVE-2026-31789** (`tensorchord/pgvecto-rs:pg16-v0.3.0`, `docker.io/library/postgres:15.17`) — openssl: heap buffer overflow on 32-bit systems from large X.509 certificate processing — _image vulnerability, out of scope_ - **CVE-2026-33186** (`ghcr.io/goauthentik/server:latest`, `netbirdio/*`, `woodpeckerci/*`) — google.golang.org/grpc: authorization bypass due to improper HTTP/2 path validation — _image vulnerability, out of scope_ - **CVE-2026-33816** (`ghcr.io/goauthentik/server:latest`) — github.com/jackc/pgx: memory-safety vulnerability — _image vulnerability, out of scope_ - **CVE-2026-33845** (`tensorchord/pgvecto-rs:pg16-v0.3.0`, `docker.io/library/postgres:15.17`) — gnutls: denial of service via DTLS zero-length fragment — _image vulnerability, out of scope_ - **CVE-2026-42010** (`tensorchord/pgvecto-rs:pg16-v0.3.0`, `docker.io/library/postgres:15.17`) — gnutls: authentication bypass via NUL character in username — _image vulnerability, out of scope_ ### HIGH severity (78 unique CVEs, abbreviated) 78 HIGH-severity CVEs spread across the same 14 images (full list: CVE-2022-27664, CVE-2022-28131, CVE-2022-2879, CVE-2022-2880, CVE-2022-29804, CVE-2022-30580, CVE-2022-30630, CVE-2022-30631, CVE-2022-30632, CVE-2022-30633, CVE-2022-30634, CVE-2022-30635, CVE-2022-32189, CVE-2022-41715, CVE-2022-41716, CVE-2022-41720, CVE-2022-41722, CVE-2022-41723, CVE-2022-41724, CVE-2022-41725, CVE-2022-49043, CVE-2023-24534, CVE-2023-24536, CVE-2023-24537, CVE-2023-24539, CVE-2023-29400, CVE-2023-29403, CVE-2023-31484, CVE-2023-39325, CVE-2023-45283, CVE-2023-45287, CVE-2023-45288, CVE-2023-52425, CVE-2024-25062, CVE-2024-34156, CVE-2024-55549, CVE-2024-56406, CVE-2025-15467, CVE-2025-22868, CVE-2025-22869, CVE-2025-24855, CVE-2025-24928, CVE-2025-27113, CVE-2025-30204, CVE-2025-31115, CVE-2025-32414, CVE-2025-32415, CVE-2025-32988, CVE-2025-32990, CVE-2025-4565, CVE-2025-47273, CVE-2025-47287, CVE-2025-49794, CVE-2025-49796, CVE-2025-57833, CVE-2025-59530, CVE-2025-6020, CVE-2025-61726, CVE-2025-61729, CVE-2025-64458, CVE-2025-66418, CVE-2025-66471, CVE-2025-67221, CVE-2025-68973, CVE-2025-69223, CVE-2025-69421, CVE-2025-7424, CVE-2025-8714, CVE-2025-8715, CVE-2026-0994, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006, CVE-2026-21226, CVE-2026-21441, CVE-2026-22184, CVE-2026-2332, CVE-2026-23949, CVE-2026-24049, CVE-2026-25679, CVE-2026-26007, CVE-2026-26209, CVE-2026-27459, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390) — all _image vulnerabilities, out of scope_. ## Notes - The IaC scan (`trivy-iac.json`) contained only Go module package inventory from `dns-server/go.mod` with no Misconfigurations results at any severity level. There are no IaC fixes to apply. - The most heavily affected images are `tensorchord/pgvecto-rs:pg16-v0.3.0` (113 findings) and `ghcr.io/goauthentik/server:latest` (109 findings). Both are managed by Flux image automation and will be remediated when upstream publishes patched images. - Several high-priority CRITICAL findings warrant attention from a reviewer even though they cannot be fixed here: CVE-2026-42010 (GnuTLS auth bypass) and CVE-2026-33186 (gRPC authorization bypass) affect runtime services. Upstream patches should be tracked. - Scan performed by Trivy 0.69.3 on 2026-05-31.
security-bot added 1 commit 2026-05-31 12:27:31 +00:00
security: agent-proposed fixes (2026-05-31) f22927bf49
k.renner merged commit 1a4828feb6 into master 2026-06-13 10:13:14 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#11