Triage 2026-09-20¶
The result of one pass over the Trivy Operator reports, kept so the next one starts from the disposition rather than the raw count. The method is in Vulnerability Triage.
Images¶
Every image with a critical finding or a fixable high.
| Image | Finding | Disposition |
|---|---|---|
CSI sidecars (csi-provisioner, csi-resizer, csi-snapshotter) |
gRPC-Go authorization bypass, CVE-2026-33186 | Fixed here. Pinned to the versions ceph-csi-operator v1.0.5 defaults to; Rook still ships v1.0.4 — see Rook-Ceph → CSI driver. The ask to bump Rook is drafted for a person to post |
argoproj/argocd v3.5.3 |
Go stdlib and x/net in bundled kustomize (Go 1.24.0) and git-lfs 3.7.1; grpc, oras-go in argocd |
Waiting on release. master has git-lfs 3.8.0, grpc 1.83.2, oras-go 2.6.2; only a new kustomize build fixes kustomize |
dexidp/dex v2.45.1 |
OpenSSL in Alpine 3.23, grpc, goxmldsig, stdlib; a second set in bundled gomplate |
Waiting on release. Fixed on master, nothing released since March 2026: dexidp/dex#4948, scan data added 2026-09-18 |
rook/ceph v1.20.7 |
Go stdlib in bundled s5cmd 2.3.0 (Go 1.22.10) |
Not reachable, waiting on release. Nothing in Rook invokes s5cmd; peak/s5cmd#873, #820 ask for a release |
home-assistant/home-assistant |
OpenSSH in Alpine 3.24.1, Go stdlib in bundled tempio (Go 1.23.3) and go2rtc, Python anyio |
Waiting on release. The base image already carries tempio 2026.07.0; weekly releases. Nothing filed, by their policy |
library/postgres 17.11 (Authentik) |
Go stdlib in gosu 1.19; libxml2 in Debian 13, no fix |
Not reachable. The stdlib CVE is TLS session resumption and gosu opens no connections; libxml2 waits on Debian |
cloudnative-pg/postgresql 18.6 |
31 highs and one critical, none with a fix (Debian 13) | Nothing to do. Base is current; every finding waits on Debian |
coredns/coredns v1.14.6 |
Two highs fixed in 1.14.7, both on DoH, DoQ and gRPC listeners | Not reachable. kubeadm's Corefile serves plain UDP and TCP; kubeadm 1.37 pins 1.14.6 |
grafana/grafana |
grpc, otel, x/net in thirteen bundled datasource plugin binaries |
Waiting on release. Rebuilt by Grafana's own release; 13.2.2 is current |
ceph/ceph v20.2.4 |
setuptools 69.2 under Python 3.9 |
Not reachable. The CVEs are in easy_install and package_index, which no daemon calls |
openbao/openbao 2.6.2 |
github.com/openbao/openbao "fixed in 2.5.4" |
Scanner artifact. A Go pseudo-version sorts below every real tag |
library/nextcloud 34.0.4 |
2887 findings, 2886 in Debian packages with no fix; one fixable LOW in bundled webauthn-lib |
Nothing to do. Base is current Debian 13; webauthn-lib is pinned ^4.9.1 upstream too. The report exists only because of the per-namespace policy (homelab-apps#28) |
goauthentik/server 2026.8.3 |
anyio 4.14.1 (critical), msgpack, setuptools; libxml2 no fix |
Waiting on release. uv.lock on main already has the fixed versions; monthly releases |
xperimental/nextcloud-exporter 0.9.1 |
Go stdlib, 28 advisories, 7 HIGH (Go 1.26.1) | Filed: xperimental/nextcloud-exporter#143. No bot bumps the builder tag |
prometheus-config-reloader v0.91.0 (Alloy's sidecar) |
Go stdlib, 4 HIGH | Waiting on chart release. main carries v0.94.0 |
| Everything else | grpc one or two patches behind, Go stdlib one patch behind |
Routine churn. Not a finding |
Scan coverage: Nextcloud and Authentik scans were dying on a five-minute Job
deadline, and their reports were then too large for etcd; fixed in
homelab-apps #26 and #28. The two exposed-secret findings are artifacts:
ssl-cert-snakeoil.key in the Postgres pods is Debian's placeholder, and the
"Azure Storage Account Key" in Nextcloud is the public Azurite development key
(ignored by homelab-apps#31).
Infra: the nodes¶
The node collector runs CIS's file checks on every node.
| Check | Path | Was | Disposition |
|---|---|---|---|
| KCV-0077 kubelet config | /var/lib/kubelet/config.yaml |
644 | Fixed, 600 |
| KCV-0075 CA file | /etc/kubernetes/pki/ca.crt |
644 | Fixed, 600 |
| KCV-0056 CNI files | /opt/cni/bin |
755 | Fixed, 700 |
| KCV-0069 kubelet unit | /lib/systemd/system/kubelet.service |
644 | Accepted. Ships in the signed, read-only sysext and holds no secret |
| KCV-0059 etcd data dir | /var/lib/etcd/default.etcd |
absent | Artifact. kubeadm uses /var/lib/etcd, already 700 etcd:etcd |
| KCV-0001 and the other API server flags | static pod args | Tracked in #660. Anonymous auth cannot simply go: the kubelet's probes rely on it (#678) |
kubeadm rewrites the first three at 644 on every init, join and upgrade,
so ansible/templates/butane_node_config.yaml.j2 ships a systemd-tmpfiles
rule that the kubelet drop-in re-applies before every start. It is
provisioning-time: a node picks it up on its next rebuild.
Config audit: the pods¶
The permanent exceptions are in What is load-bearing. Changed on this pass:
| Where | Disposition |
|---|---|
| Argo CD, External Secrets, Trivy Operator, metrics-server, kubelet-csr-approver, snapshot-controller, Alloy | KSV-0118 only, fixed (#791; homelab-apps#27 for Trivy Operator). Containers already ran non-root; the pod-level context was empty. Kured's chart has no pod-level value; CoreDNS is kubeadm's |
| Authentik | Fixed (#792): non-root, no capabilities, no escalation, runtime seccomp. Read-only root not attempted: the image writes under /media and /templates |
| Nextcloud, Home Assistant | Seccomp only (homelab-apps#30) |
| Velero | Node agent and plugin init container confined (#794); the velero container is unchanged pending a real backup — see Velero |
| trivy-server, nextcloud-exporter | Fixed (homelab-apps#32, #31) |
etcd-backup CronJob |
Own manifest, hardened |
Of the medium count, KSV-0125 and the root, escalation and seccomp findings
in rook-ceph and kube-system are the load-bearing set; outside those two
namespaces the remaining rows are the ones above. Nine ConfigAuditReports
belonged to superseded ReplicaSets; the Deployments this repository controls
now keep one or two (homelab-apps#33), and Nextcloud's chart has no value for
it.
RBAC¶
Every critical and high is a chart's operator ClusterRole or Kubernetes' own
admin, edit and cluster-admin. Nothing filed, nothing changed.