# Triage 2026-09-20 The result of one pass over the Trivy Operator reports, kept so the next one starts from the disposition rather than the raw count. The method is in [Vulnerability Triage](). ## Images Every image with a critical finding or a fixable high. | Image | Finding | Disposition | | --- | --- | --- | | CSI sidecars (`csi-provisioner`, `csi-resizer`, `csi-snapshotter`) | gRPC-Go authorization bypass, CVE-2026-33186 | **Fixed here.** Pinned to the versions ceph-csi-operator v1.0.5 defaults to; Rook still ships v1.0.4 — see [Rook-Ceph → CSI driver](). The ask to bump Rook is drafted for a person to post | | `argoproj/argocd` v3.5.3 | Go stdlib and `x/net` in bundled `kustomize` (Go 1.24.0) and `git-lfs` 3.7.1; `grpc`, `oras-go` in argocd | **Waiting on release.** `master` has git-lfs 3.8.0, grpc 1.83.2, oras-go 2.6.2; only a new kustomize build fixes kustomize | | `dexidp/dex` v2.45.1 | OpenSSL in Alpine 3.23, `grpc`, `goxmldsig`, stdlib; a second set in bundled `gomplate` | **Waiting on release.** Fixed on `master`, nothing released since March 2026: [dexidp/dex\#4948](), scan data added 2026-09-18 | | `rook/ceph` v1.20.7 | Go stdlib in bundled `s5cmd` 2.3.0 (Go 1.22.10) | **Not reachable, waiting on release.** Nothing in Rook invokes `s5cmd`; [peak/s5cmd\#873](), [\#820]() ask for a release | | `home-assistant/home-assistant` | OpenSSH in Alpine 3.24.1, Go stdlib in bundled `tempio` (Go 1.23.3) and `go2rtc`, Python `anyio` | **Waiting on release.** The base image already carries tempio 2026.07.0; weekly releases. Nothing filed, by their policy | | `library/postgres` 17.11 (Authentik) | Go stdlib in `gosu` 1.19; `libxml2` in Debian 13, no fix | **Not reachable.** The stdlib CVE is TLS session resumption and gosu opens no connections; libxml2 waits on Debian | | `cloudnative-pg/postgresql` 18.6 | 31 highs and one critical, none with a fix (Debian 13) | **Nothing to do.** Base is current; every finding waits on Debian | | `coredns/coredns` v1.14.6 | Two highs fixed in 1.14.7, both on DoH, DoQ and gRPC listeners | **Not reachable.** kubeadm's Corefile serves plain UDP and TCP; kubeadm 1.37 pins 1.14.6 | | `grafana/grafana` | `grpc`, `otel`, `x/net` in thirteen bundled datasource plugin binaries | **Waiting on release.** Rebuilt by Grafana's own release; 13.2.2 is current | | `ceph/ceph` v20.2.4 | `setuptools` 69.2 under Python 3.9 | **Not reachable.** The CVEs are in `easy_install` and `package_index`, which no daemon calls | | `openbao/openbao` 2.6.2 | `github.com/openbao/openbao` "fixed in 2.5.4" | **Scanner artifact.** A Go pseudo-version sorts below every real tag | | `library/nextcloud` 34.0.4 | 2887 findings, 2886 in Debian packages with no fix; one fixable LOW in bundled `webauthn-lib` | **Nothing to do.** Base is current Debian 13; `webauthn-lib` is pinned `^4.9.1` upstream too. The report exists only because of the per-namespace policy (homelab-apps\#28) | | `goauthentik/server` 2026.8.3 | `anyio` 4.14.1 (critical), `msgpack`, `setuptools`; `libxml2` no fix | **Waiting on release.** `uv.lock` on `main` already has the fixed versions; monthly releases | | `xperimental/nextcloud-exporter` 0.9.1 | Go stdlib, 28 advisories, 7 HIGH (Go 1.26.1) | **Filed:** [xperimental/nextcloud-exporter\#143](). No bot bumps the builder tag | | `prometheus-config-reloader` v0.91.0 (Alloy's sidecar) | Go stdlib, 4 HIGH | **Waiting on chart release.** `main` carries v0.94.0 | | Everything else | `grpc` one or two patches behind, Go stdlib one patch behind | **Routine churn.** Not a finding | Scan coverage: Nextcloud and Authentik scans were dying on a five-minute Job deadline, and their reports were then too large for etcd; fixed in homelab-apps \#26 and \#28. The two exposed-secret findings are artifacts: `ssl-cert-snakeoil.key` in the Postgres pods is Debian's placeholder, and the "Azure Storage Account Key" in Nextcloud is the public Azurite development key (ignored by homelab-apps\#31). ## Infra: the nodes The node collector runs CIS's file checks on every node. | Check | Path | Was | Disposition | | --- | --- | --- | --- | | KCV-0077 kubelet config | `/var/lib/kubelet/config.yaml` | 644 | **Fixed**, 600 | | KCV-0075 CA file | `/etc/kubernetes/pki/ca.crt` | 644 | **Fixed**, 600 | | KCV-0056 CNI files | `/opt/cni/bin` | 755 | **Fixed**, 700 | | KCV-0069 kubelet unit | `/lib/systemd/system/kubelet.service` | 644 | **Accepted.** Ships in the signed, read-only sysext and holds no secret | | KCV-0059 etcd data dir | `/var/lib/etcd/default.etcd` | absent | **Artifact.** kubeadm uses `/var/lib/etcd`, already `700 etcd:etcd` | | KCV-0001 and the other API server flags | static pod args | | **Tracked in \#660.** Anonymous auth cannot simply go: the kubelet's probes rely on it (\#678) | kubeadm rewrites the first three at 644 on every `init`, `join` and `upgrade`, so `ansible/templates/butane_node_config.yaml.j2` ships a `systemd-tmpfiles` rule that the kubelet drop-in re-applies before every start. It is provisioning-time: a node picks it up on its next rebuild. ## Config audit: the pods The permanent exceptions are in [What is load-bearing](). Changed on this pass: | Where | Disposition | | --- | --- | | Argo CD, External Secrets, Trivy Operator, metrics-server, kubelet-csr-approver, snapshot-controller, Alloy | **`KSV-0118` only, fixed** (\#791; homelab-apps\#27 for Trivy Operator). Containers already ran non-root; the pod-level context was empty. Kured's chart has no pod-level value; CoreDNS is kubeadm's | | Authentik | **Fixed** (\#792): non-root, no capabilities, no escalation, runtime seccomp. Read-only root not attempted: the image writes under `/media` and `/templates` | | Nextcloud, Home Assistant | **Seccomp only** (homelab-apps\#30) | | Velero | **Node agent and plugin init container confined** (\#794); the `velero` container is unchanged pending a real backup — see [Velero]() | | trivy-server, nextcloud-exporter | **Fixed** (homelab-apps\#32, \#31) | | `etcd-backup` CronJob | **Own manifest, hardened** | Of the medium count, `KSV-0125` and the root, escalation and seccomp findings in `rook-ceph` and `kube-system` are the load-bearing set; outside those two namespaces the remaining rows are the ones above. Nine `ConfigAuditReport`s belonged to superseded ReplicaSets; the Deployments this repository controls now keep one or two (homelab-apps\#33), and Nextcloud's chart has no value for it. ## RBAC Every critical and high is a chart's operator `ClusterRole` or Kubernetes' own `admin`, `edit` and `cluster-admin`. Nothing filed, nothing changed.